Squarespace GDPR Checklist (2024) — The 7 Key Tasks

In this Squarespace GDPR checklist, I’m going to walk you through 7 key tasks you need to complete to ensure a fully-compliant website. Read on to find out about the legal texts you’ll need to display, how to handle data capture, and the tool you’ll need to create a GDPR-compliant cookie banner.

With the EU’s introduction of GDPR — General Data Protection Regulation — business owners now have to follow very strict rules around how they process personal data.

This is especially true if you run a website — the digital tool most commonly used by businesses to capture it.

Now, as somebody with a history of building Squarespace websites, I’ve been asked on a large number of occasions to help make these sites GDPR compliant. So, in this post, I thought I’d outline the main things you need to do just that — below you’ll find a useful checklist of GDPR tasks that are specifically aimed at Squarespace site owners.

However, please note that I am not a lawyer, so the below information should not be interpreted as formal legal advice.

(It’s always advisable to get professional legal advice in order to ensure your business is fully GDPR compliant.)

With that disclaimer out of the way, let’s start this GDPR checklist by looking at the documentation you’re going to need to host and display on your website.

1. Create the right legal documents for your Squarespace site

There are usually three documents you need to create for use on your Squarespace website — or indeed any website! — in order to ensure GDPR compliance.

These are:

Let’s look at each in turn.

Website terms of use

As their name suggests, website terms of use — also known as ‘website terms and conditions’ or ‘terms of service’ — govern the use of your website by your visitors.

These texts spell out to your site users what they should expect from you, and what you should expect from them.

Website terms of use documents usually contain:

In terms of how you create a website terms of use document, you can either work with a lawyer — this is obviously the safest approach — or use a template to generate one.

If commissioning a lawyer, try to work with one who specializes in data protection.

As for templates, there are a large number of free and paid-for options available online, but you’ll need to find one that’s appropriate for your particular locale or legal jurisdiction.

Privacy policy

A privacy policy outlines how your business collects, stores and uses personal data gathered via your website.

Examples of personal data include:

Your privacy policy needs to explain:

Again, you have two choices here regarding how you craft a privacy policy — ask a lawyer to help you, or use a template.

Cookies notice

Cookies are small text files placed on a user’s computer by websites; they are typically used to collect personal data.

They gather information about a visitor’s use of the website (pages visited, links clicked etc.) or enable the website to recognize a user as an existing visitor or customer when he/she visits it again.

Your Squarespace site needs a cookie notice that outlines:

As with the terms of use and privacy policy documents, you can either commission a lawyer to create a cookies notice, or use a template to provide one.

If you’re struggling to find a template, the Terms Feed website has a useful sample cookies policy you can review (along with useful information on cookies in general).

I’ll return to the issues of cookies later, as dealing with cookie consent properly is the trickiest part of making a Squarespace site GDPR compliant — you’ll need to do more than simply publish a cookies notice to ensure compliance.

2. Convert your legal documents into Squarespace pages

Once you’ve got the above three key documents ready, they need to be converted into standard Squarespace pages.

I usually do this by going to the Squarespace Dashboard > Pages > Not Linked section and adding them there.

Unfortunately, with legal documents of these nature, it’s usually not just a case of copying and pasting their contents directly into a Squarespace page — there is often a fair bit of cleaning up to do once you paste them into Squarespace.

(This is due perhaps to a lawyerly love of numbering and indenting things!).

To minimize formatting problems, I usually suggest using a ‘Paste and Match Style’ or similar option to insert the contents into the page.

Alternatively, you can paste the content in and use the ‘Remove Text Style’ icon in the Squarespace formatting bar to remove any formatting afterwards.

Either way, you’ll then have to make sure you comb through your new pages carefully to ensure that the contents of your documents have been imported into Squarespace correctly, and that you are not presenting your site visitors with any odd spacing or formatting issues.

All your legal documents must be easy for your visitors to access, read and understand.

3. Add links to legal texts in your footer

Links to your terms of use document, privacy policy and cookies notice should ideally be visible on every page of your site.

The easiest way to ensure that this is the case is to add them as links in your footer (as per the screenshot above).

Just add the document titles to your footer, highlight them and add the links as you normally would when creating any internal link in Squarespace.

If you need help with this, check out the resource page on the Squarespace website about editing footers — or you can watch the video below.

4. Make your mailing list forms ‘honest’

If you’re using data capture forms on your Squarespace site to encourage people to join an email list, you need to ensure that you are being 100% transparent about their purpose.

Some important rules about this transparency and consent apply, but the key ones for most Squarespace users with mailing list sign-up forms are probably as follows:

The ‘active opt-in’ bit is usually the issue that causes the most confusion amongst site owners — many take this to mean that every form has to have a checkbox.

However, my understanding is that for standalone mailing list forms — i.e., forms that are exclusively used to add people to a mailing list — a button is sufficient, so long as the context makes it very clear that by clicking the button you are signing up to a list.

So, when designing these sorts of forms in Squarespace, I tend to use a ‘Subscribe’ button rather than a ‘Submit’ button to hammer home the active opt-in aspect.

For other forms — contact forms, application forms and so on — a checkbox will usually be necessary to gain the active opt-in however, as the primary purpose of these sorts of forms is not joining a mailing list but supplying information for some other use.

Some exceptions apply, however, so you may be able pre-populate checkboxes in certain contexts.

(It’s best to get a legal opinion on this.)

5. Send your form data somewhere very safe

If you’re using forms to capture data on Squarespace, you need to make sure that they are sending the data somewhere where it will be stored securely.

If, for example, you’re just sending data from Squarespace to your email account and then adding it to an Excel spreadsheet stored locally on your non-password-protected laptop….you’re not meeting GDPR requirements!

Usually the best way to ensure compliance in this area is to link your Squarespace forms to a dedicated email marketing tool like Mailchimp or GetResponse, both of which take stringent approaches to ensuring GDPR compliance.

It’s a good idea to familiarize yourself with official GDPR guidelines on data security too, particularly if you are handling large quantities of personal data, or sensitive personal data.

Another thing you’ll need to need to consider is where your date is being stored — the EU has rules that need to be followed if you’re transferring personal data outside it.

Finally, familiarizing yourself with the basic principles of cybersecurity is also a good idea when it comes to keeping your customers and subscribers’ data safe.

Now, let’s take a look at the trickiest part of making a Squarespace site GDPR compliant: cookie banners.

6. Add a GDPR compliant cookie banner to your Squarespace site

Obtaining cookie consent is probably the trickiest aspect of making a Squarespace site GDPR-compliant.

As discussed earlier, cookies usually refer to small files which websites place on a website visitor’s hard drive in order to track or ‘understand’ those visitors.

They can be used for a wide variety of purposes; key examples include:

One of the biggest implications of GDPR — and probably the biggest for Squarespace site owners — is that no non-essential cookies should be run without your site visitors providing explicit consent for this to happen.

As the name suggests, non-essential cookies cover anything that is not 100% vital for your site to function correctly — meaning that cookies used by popular services such as Google Analytics, Google Adwords, Facebook and Twitter cannot be used on your site until your users give their express permission — known as ‘prior consent’ — for them to be run.

In addition to requiring you to give your your site visitors a means to give this prior consent, GDPR also requires you to log that consent and provide users with a means to revoke it.

The main problem here is that out of the box, Squarespace does not provide your users with any way to opt out of third-party cookies before they are run.

Yes, a cookie banner is provided by Squarespace which you can use to notify users that cookies are used on your site, and this allows visitors to opt-out of the non-essential cookies used by Squarespace Analytics (the built-in analytics tool).

Squarespace is quite explicit about this, as you can see from its statement on using its cookie banner, below.

In short, the Squarespace cookie banner doesn’t:

So in truth, it’s not really fit for purpose as far as GDPR compliance goes.

This means that to avoid breaking GDPR rules whilst using a Squarespace site, you will either need to code your own cookie consent solution (not really an option for most Squarespace users), or integrate a paid-for cookie consent tool that works with Squarespace.

(Alternatively, you can refrain from adding any third-party cookies to your site, and disabling the non-essential Squarespace analytics cookies too — but this won’t be practical for most Squarespace site owners).

Now, after quite a bit of digging, I’ve settled on a product called CookieYes as a GDPR compliant solution for managing cookie consent with Squarespace (chiefly because competing products don’t yet work with Squarespace; require a lot of manual coding; or don’t provide implementation support).

CookieYes works by scanning your website for any cookies and then allowing you to assign the ones it finds to various categories – strictly essential, performance, tracking, social etc.

It then allows you to add a cookie banner to your Squarespace site (via the addition of a script) which gives visitors the option to either run them all, or access a control panel where they can can access fine-grain, prior consent control over the cookies used on the site.

You can find out how to install CookieYes on a Squarespace site here.

(Note however that CookieYes is not the only third-party cookie banner tool available to Squarespace users — there are quite a few available).

7. Check your policies and contracts

The above steps should help you get your website broadly in shape for GDPR and broadly compliant with its requirements.

However, there are quite a lot of other less ‘public-facing’ aspects of GDPR that you should also factor into proceedings — and which may impact how you can use your website.

Things you might additionally need to think about include:

…and much else besides!

To help you understand these, I’d recommend reading the guide to GDPR on the GDPR.EU website — it contains an overview of all the key issues along with useful checklists that guide you through the process of becoming compliant.

And, as mentioned more than once in this post, it’s also advisable to ask a lawyer to look over your Squarespace website once you’ve put the above measures in place, and to provide you with advice about GDPR compliance in general.

Good luck with making your Squarespace website compliant, and do feel free to leave any questions in the comments section below! We’ll do our best to help.