Why GDPR is mostly useless bureaucracy for small businesses and freelancers
I am a web design freelancer, photographer and filmmaker and GDPR is useless and an extra pain for me.
I run a few simple websites. I don’t care where my visitors come from. I don’t track them, I don’t build profiles, and I have zero interest in analytics dashboards. The only personal data I ever want is an email address — and only when a potential client voluntarily contacts me. That’s it.
I have clients who run small businesses just like mine. Many of them are completely clueless about data analytics. They simply want to put their products or services on a website and nothing more. GDPR affects them the same way it affects me — creating unnecessary paperwork, costs and stress for people who never collect or care about visitor data beyond a contact form.
If I install Google Analytics or Facebook comments, those companies get the data. I don’t. And even if I somehow did, I still wouldn’t care. Yet under GDPR I’m expected to treat every website as if I’m running a surveillance operation.
For a freelancer or a small one-person business, this is pure overhead with almost no real benefit.
The compliance burden hits the wrong people
Big tech companies have armies of lawyers and privacy engineers. They can absorb the cost of cookie banners, consent management platforms, data processing agreements, records of processing activities, and the rest of the paperwork. A solo web designer, copywriter, or niche ecommerce seller cannot.
Many small site owners end up either:
- Paying for expensive consent tools they barely understand, or
- Throwing up a generic “We use cookies” banner that doesn’t actually meet the requirements, or
- Simply avoiding useful tools (analytics, chat widgets, comment systems) because the legal risk feels too high.
The result is more friction for legitimate small operators and almost no meaningful restriction on the companies that actually collect data at scale.
Consent theater doesn’t stop the real data collectors
Most cookie banners are ignored or clicked through. Users have trained themselves to dismiss them. Meanwhile the largest platforms continue to track people across the web through logged-in states, device fingerprinting, and other methods that are far harder for a small site owner to control or even detect.
If my only “processing” is receiving an email from someone who wants to hire me, forcing me to maintain a privacy policy, appoint a DPO-equivalent mindset, and document everything is disproportionate. The regulation treats a contact form the same way it treats a behavioral advertising network.
Risk without reward
The theoretical risk of a fine exists even for tiny sites. In practice the biggest enforcement actions target large companies, but the chilling effect is real: freelancers spend time and money on compliance theater instead of serving clients. Some simply stay under the radar and hope no one notices. Others over-comply and make their sites worse (more banners, slower load times, fewer features).
For someone whose entire “data processing” consists of an email inbox and maybe a simple contact form, GDPR adds cost and complexity while delivering negligible extra protection to the people contacting them. Those people already chose to send their email address.
A better approach would be risk-based and proportional
Rules should scale with actual risk and volume of data. A one-person business that never sells data, never profiles users, and only stores voluntary contact details should not face the same compliance regime as a company that monetizes behavioral tracking across millions of users.
Until that happens, GDPR remains, for many small operators, an expensive, time-consuming exercise that mainly benefits lawyers, consent-tool vendors, and large platforms that can afford to treat it as a cost of doing business.
I just want to run simple websites, answer client emails, and get paid for work. Everything beyond that is noise.
So, no I am not use your data when you visite my website, if u let a comment on blog posts or contact me via form. Because, if you realy are interested on my services we can talk later how you can contact me and how we can meet to drink a cofee.
