If you design and develop websites for other businesses, regulatory compliance affects you twice over. On the one hand, your own website must comply with the GDPR, the LSSI, the AI Act, and all consumer protection law requirements. On the other hand, the websites you deliver to your clients must also comply with all these regulations.
In this guide, we review what a website needs to comply with the GDPR and how you can automate the entire process to ensure everything stays up to date as regulations change.
Every website that processes personal data or uses cookies needs, at a minimum:
Every website must have a banner that blocks non-essential cookies until valid consent has been recorded. Consent must be given in advance and must be informed, freely given, and specific. This has several technical implications:
If your client uses Google Ads or Google Analytics, it is particularly important that the banner is compatible with Google Consent Mode v2 to manage consent correctly and avoid losing valuable measurement data.
The GDPR grants users the rights of access, rectification, erasure, objection, restriction of processing, and data portability (ARSOPOL). This means that both your website and your clients' websites must provide a clear channel through which users can exercise these rights, with requests handled within the deadlines established by law.
If your clients sell online, they must comply not only with the GDPR but also with all the obligations established by consumer protection legislation.
Current legislation establishes that consumers have 14 calendar days to withdraw from an online purchase without having to provide a reason. In addition, on July 19, 2026, the mandatory withdrawal button came into force, requiring ecommerce businesses to provide a dedicated, visible, and accessible function for exercising the right of withdrawal, making it as easy to withdraw from a purchase as it is to make one.
Therefore, it is essential that your website and your clients' websites provide a genuine way to exercise this right and that their terms and conditions of sale adequately regulate the right of withdrawal.
Although this is not strictly a GDPR requirement, you should also take it into account because it is one of the new developments most likely to catch agencies by surprise. The AI Act establishes transparency obligations, and from August 2, 2026, the requirements relating to the identification of AI-generated or AI-modified content begin to apply.
Many websites include product photos that have been retouched or generated using AI. A common example is photographing a product in red and then using AI to recolor it to show the other available colors, saving time and production costs.
With the AI Act coming into effect, it is therefore important to inform website users about images generated or modified using AI where required. We also recommend informing the agencies in your client portfolio about this new labeling obligation.
The practical challenge is determining which images fall into this category, especially when they come from suppliers or image libraries, since you may not know whether they have actually been generated or modified using AI.
If your client fails to label them correctly, they may be held responsible and face a fine. It is therefore essential to make your clients aware of these new labeling requirements.
Since June 28, 2025, Law 11/2023, which transposes the European Accessibility Act (EAA), has required many digital services to be accessible to people with disabilities. These include ecommerce, banking, transport, and communication services. Microenterprises providing services are exempt if they have fewer than 10 employees and an annual turnover of no more than €2 million.
In practice, websites must follow the WCAG guidelines: alternative text for images, sufficient color contrast, keyboard navigation, properly structured headings, and labeled forms. They must also explain how they meet these requirements.
For a web design agency, accessibility must be considered from the design stage. Fixing accessibility issues later is more expensive. An accessible website can also perform better in search rankings because Google can better understand its alternative text and heading structure.
Legal documents that are always up to date. Lawwwing generates customized legal documents for each website and updates them automatically, with integrations for WordPress, Shopify, and other content management systems. It includes terms and conditions of sale and terms of use that regulate the right of withdrawal in accordance with current legislation.
Google-certified cookie banner. Lawwwing is a Google-certified CMP in the Gold category. Consent Mode v2 is included in all plans, while the Professional Plan adds IAB TCF v2.4 for advanced advertising.
Data subject rights form (DSAR). Simply telling users to "email us at this address" does not provide traceability. Lawwwing includes a data subject rights request form that allows you to receive and manage all requests from a single place.
AI Sentinel for AI-generated images. It periodically scans your website, locates images, and analyzes them using its own detection engine, with a reported reliability rate of 98.5%. To avoid altering the design or affecting sales, it does not overlay labels on photos. Instead, it displays the relevant information in an accessible floating widget.
Accessibility widget. Each visitor can adapt the website to their needs by adjusting contrast, text size, choosing a dyslexia-friendly font, or changing the cursor size. It also automatically fixes common WCAG 2.2 issues, such as missing alternative text, insufficient contrast, and incorrect tab order, without modifying the code. If the website already uses Lawwwing, the widget can be activated from the dashboard in under five minutes, without installing anything else.
Continuous monitoring. The compliance scanner and Audit API periodically review websites to identify compliance issues before they become a problem.
Still have questions? Get compliant with Lawwwing today.
| Requirement | Lawwwing Feature |
|---|---|
| Legal notice, privacy policy, cookie policy, and consent clauses | Legal document generation and automatic updates |
| Cookie consent and Google Consent Mode v2 | Cookie banner (Google Gold-certified CMP) |
| User rights | DSAR request form |
| Ecommerce right of withdrawal | Withdrawal button and terms and conditions of sale |
| Transparency of AI-generated content | AI Sentinel |
| Continuous monitoring | Compliance scanner and Audit API |
