{"id":13236,"date":"2026-11-02T08:30:00","date_gmt":"2026-11-02T07:30:00","guid":{"rendered":"https:\/\/lawwwing.com\/?p=13236"},"modified":"2026-10-26T15:54:39","modified_gmt":"2026-10-26T14:54:39","slug":"gdpr-web-design-agencies","status":"publish","type":"post","link":"https:\/\/lawwwing.com\/en\/gdpr-web-design-agencies\/","title":{"rendered":"Are You a Web Design Agency? How Your Website Must Comply with the GDPR"},"content":{"rendered":"\n
<\/div>\n\n\n\n

If you design and develop websites for other businesses, regulatory compliance affects you twice over. On the one hand, your own website must comply with the GDPR, the LSSI, the AI Act, and all consumer protection law requirements. On the other hand, the websites you deliver to your clients must also comply with all these regulations.<\/p>\n\n\n\n

In this guide, we review what a website needs to comply with the GDPR and how you can automate the entire process to ensure everything stays up to date as regulations change.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Website Compliance Checklist for 2026<\/h2>\n\n\n\n
    \n
  • Up-to-date legal notice, privacy policy, and cookie policy<\/li>\n\n\n\n
  • Consent clauses in all forms<\/li>\n\n\n\n
  • Terms and conditions of sale and terms of use adapted to consumer protection regulations<\/li>\n\n\n\n
  • Cookie banner with prior cookie blocking and Google Consent Mode v2<\/li>\n\n\n\n
  • A channel for exercising data subject rights (ARSOPOL), with traceability<\/li>\n\n\n\n
  • Withdrawal button for ecommerce stores<\/li>\n\n\n\n
  • Disclosure of AI-generated or AI-modified content where required<\/li>\n\n\n\n
  • Website accessibility in accordance with WCAG 2.2 and Law 11\/2023 (the European Accessibility Act)<\/li>\n<\/ul>\n\n\n\n
    <\/div>\n\n\n\n

    1. Legal Documents: The Foundation of Every Website<\/h2>\n\n\n\n

    Every website that processes personal data or uses cookies needs, at a minimum:<\/p>\n\n\n\n

      \n
    • Legal notice<\/strong>, clearly identifying the website owner.<\/li>\n\n\n\n
    • Privacy policy<\/strong>, containing the information required by the GDPR: who processes the data, for what purposes, on what legal basis, for how long, and which third parties receive it.<\/li>\n\n\n\n
    • Cookie policy<\/strong>, consistent with the cookies actually loaded by the website.<\/li>\n\n\n\n
    • Consent collection clauses<\/strong> in contact forms, newsletter subscriptions, and registration forms.<\/li>\n\n\n\n
    • Terms and conditions of sale<\/strong> and terms of use<\/strong>, updated to comply with current legislation and covering all requirements relating to shipping, warranties, returns, and the right of withdrawal.<\/li>\n<\/ul>\n\n\n\n
      <\/div>\n\n\n\n

      2. Cookie Banner and Consent Mode v2<\/h2>\n\n\n\n

      Every website must have a banner that blocks non-essential cookies until valid consent has been recorded. Consent must be given in advance and must be informed, freely given, and specific. This has several technical implications:<\/p>\n\n\n\n

        \n
      • Non-essential cookies, including analytics, advertising, and social media cookies, must not be loaded before the user accepts them.<\/li>\n\n\n\n
      • Rejecting cookies must be just as easy as accepting them.<\/li>\n\n\n\n
      • Users must be able to configure cookie categories separately.<\/li>\n\n\n\n
      • Users must be able to change or withdraw their consent at any time.<\/li>\n<\/ul>\n\n\n\n

        If your client uses Google Ads or Google Analytics, it is particularly important that the banner is compatible with Google Consent Mode v2<\/strong> to manage consent correctly and avoid losing valuable measurement data.<\/p>\n\n\n\n

        <\/div>\n\n\n\n

        3. Exercising Data Subject Rights and DSAR Management<\/h2>\n\n\n\n

        The GDPR grants users the rights of access, rectification, erasure, objection, restriction of processing, and data portability (ARSOPOL). This means that both your website and your clients' websites must provide a clear channel through which users can exercise these rights, with requests handled within the deadlines established by law.<\/p>\n\n\n\n

        <\/div>\n\n\n\n

        4. The Right of Withdrawal in Ecommerce<\/h2>\n\n\n\n

        If your clients sell online, they must comply not only with the GDPR but also with all the obligations established by consumer protection legislation.<\/p>\n\n\n\n

        Current legislation establishes that consumers have 14 calendar days to withdraw from an online purchase without having to provide a reason. In addition, on July 19, 2026, the mandatory withdrawal button<\/strong> came into force, requiring ecommerce businesses to provide a dedicated, visible, and accessible function for exercising the right of withdrawal, making it as easy to withdraw from a purchase as it is to make one.<\/p>\n\n\n\n

        Therefore, it is essential that your website and your clients' websites provide a genuine way to exercise this right and that their terms and conditions of sale adequately regulate the right of withdrawal.<\/p>\n\n\n\n

        <\/div>\n\n\n\n

        5. Artificial Intelligence: Labeling Images Under the AI Act<\/h2>\n\n\n\n

        Although this is not strictly a GDPR requirement, you should also take it into account because it is one of the new developments most likely to catch agencies by surprise. The AI Act establishes transparency obligations, and from August 2, 2026, the requirements relating to the identification of AI-generated or AI-modified content begin to apply.<\/p>\n\n\n\n

        Many websites include product photos that have been retouched or generated using AI. A common example is photographing a product in red and then using AI to recolor it to show the other available colors, saving time and production costs.<\/p>\n\n\n\n

        With the AI Act coming into effect, it is therefore important to inform website users about images generated or modified using AI where required. We also recommend informing the agencies in your client portfolio about this new labeling obligation.<\/p>\n\n\n\n

        The practical challenge is determining which images fall into this category, especially when they come from suppliers or image libraries, since you may not know whether they have actually been generated or modified using AI.<\/p>\n\n\n\n

        If your client fails to label them correctly, they may be held responsible and face a fine. It is therefore essential to make your clients aware of these new labeling requirements.<\/p>\n\n\n\n

        <\/div>\n\n\n\n

        6. Website Accessibility: Law 11\/2023 and the European Accessibility Act<\/h2>\n\n\n\n

        Since June 28, 2025, Law 11\/2023, which transposes the European Accessibility Act (EAA), has required many digital services to be accessible to people with disabilities. These include ecommerce, banking, transport, and communication services. Microenterprises providing services are exempt if they have fewer than 10 employees and an annual turnover of no more than \u20ac2 million.<\/p>\n\n\n\n

        In practice, websites must follow the WCAG guidelines: alternative text for images, sufficient color contrast, keyboard navigation, properly structured headings, and labeled forms. They must also explain how they meet these requirements.<\/p>\n\n\n\n

        For a web design agency, accessibility must be considered from the design stage. Fixing accessibility issues later is more expensive. An accessible website can also perform better in search rankings because Google can better understand its alternative text and heading structure.<\/p>\n\n\n\n

        <\/div>\n\n\n\n

        What Can Lawwwing Do for Your Agency?<\/h2>\n\n\n\n

        Legal documents that are always up to date.<\/strong> Lawwwing generates customized legal documents for each website and updates them automatically, with integrations for WordPress, Shopify, and other content management systems. It includes terms and conditions of sale and terms of use that regulate the right of withdrawal in accordance with current legislation.<\/p>\n\n\n\n

        Google-certified cookie banner.<\/strong> Lawwwing is a Google-certified CMP in the Gold category. Consent Mode v2 is included in all plans, while the Professional Plan adds IAB TCF v2.4 for advanced advertising.<\/p>\n\n\n\n

        Data subject rights form (DSAR).<\/strong> Simply telling users to \"email us at this address\" does not provide traceability. Lawwwing includes a data subject rights request form that allows you to receive and manage all requests from a single place.<\/p>\n\n\n\n

        AI Sentinel for AI-generated images.<\/strong> It periodically scans your website, locates images, and analyzes them using its own detection engine, with a reported reliability rate of 98.5%. To avoid altering the design or affecting sales, it does not overlay labels on photos. Instead, it displays the relevant information in an accessible floating widget.<\/p>\n\n\n\n

        Accessibility widget.<\/strong> Each visitor can adapt the website to their needs by adjusting contrast, text size, choosing a dyslexia-friendly font, or changing the cursor size. It also automatically fixes common WCAG 2.2 issues, such as missing alternative text, insufficient contrast, and incorrect tab order, without modifying the code. If the website already uses Lawwwing, the widget can be activated from the dashboard in under five minutes, without installing anything else.<\/p>\n\n\n\n

        Continuous monitoring.<\/strong> The compliance scanner and Audit API periodically review websites to identify compliance issues before they become a problem.<\/p>\n\n\n\n

        Still have questions? Get compliant with Lawwwing<\/strong> today.<\/p>\n\n\n\n

        <\/div>\n\n\n\n
        Requirement<\/strong><\/th>Lawwwing Feature<\/strong><\/th><\/tr>
        Legal notice, privacy policy, cookie policy, and consent clauses<\/td>Legal document generation and automatic updates<\/td><\/tr>
        Cookie consent and Google Consent Mode v2<\/td>Cookie banner (Google Gold-certified CMP)<\/td><\/tr>
        User rights<\/td>DSAR request form<\/td><\/tr>
        Ecommerce right of withdrawal<\/td>Withdrawal button and terms and conditions of sale<\/td><\/tr>
        Transparency of AI-generated content<\/td>AI Sentinel<\/td><\/tr>
        Continuous monitoring<\/td>Compliance scanner and Audit API<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        <\/p>\n","protected":false},"excerpt":{"rendered":"

        If you design and develop websites for other businesses, regulatory compliance affects you twice over. On the one hand, your own website must comply with the GDPR, the LSSI, the AI Act, and all consumer protection law requirements. On the other hand, the websites you deliver to your clients must also comply with all these […]<\/p>\n","protected":false},"author":22,"featured_media":13408,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[15,73,627,315,12,24,37,59,13,14,50,3,11,6,21,20,19,16,7,5,4],"tags":[363,449,509,577,739,799,1019,1021,1022],"class_list":["post-13236","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-banner-cookies","category-inteligencia-artificial","category-privacidad-y-proteccion-de-datos-ue","category-datos-personales","category-cookies-web","category-terms-and-conditions","category-legislacion-web","category-texto-legal-web","category-terminos-de-uso","category-terminos-de-compra","category-politica-de-privacidad-pagina-web","category-aviso-legal","category-politica-de-cookies","category-cookies","category-politica-de-privacidad","category-proteccion-de-datos","category-gdpr","category-textos-legales-web","category-compliance","category-rgpd","category-privacy","tag-cookies","tag-ia-3","tag-website","tag-rgpd-2","tag-ai-act-2","tag-legal-text","tag-gdpr-for-web-design-agencies","tag-agency","tag-design-web-agencies"],"acf":[],"_links":{"self":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts\/13236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/comments?post=13236"}],"version-history":[{"count":1,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts\/13236\/revisions"}],"predecessor-version":[{"id":13240,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/posts\/13236\/revisions\/13240"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/media\/13408"}],"wp:attachment":[{"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/media?parent=13236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/categories?post=13236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lawwwing.com\/en\/wp-json\/wp\/v2\/tags?post=13236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}