Legal Requirements for Websites and Apps: European Union

Start with your business location, the markets you target, and what your product actually does. Foreign privacy and consumer laws can apply, but a website being accessible from a country is not by itself a universal legal trigger. For example, GDPR territorial scope includes processing in the context of an EU establishment, or a non-EU business offering goods or services to people in the EU or monitoring their behaviour there. Assess each law separately. Also assess accessibility for covered products and services, intermediary duties, relevant AI transparency obligations and the withdrawal function for covered online consumer contracts. The good news is that the EU rulebook is coherent. Several controls can be reused in other markets, but EU compliance does not establish compliance with their local laws. The bad news is the enforcement ceiling: up to 4% of global annual turnover under the GDPR. This is the EU chapter of our pre-launch legal checklist. Run that prompt sequence first, then layer this on.

Key takeaways

• Establishment, targeted offering and monitoring determine GDPR territorial scope; mere availability does not.
• Classify legal bases, vendor roles and transfer safeguards rather than calling every vendor a processor.
• Consent is generally required for non-exempt tracking; limited national exceptions exist.
• EAA scope and microenterprise exemptions need a service-specific assessment.
• Article 50 duties differ for AI providers and deployers.
• Covered online contracts with a withdrawal right need the required withdrawal function under national measures applying from 19 June 2026.
• France and Spain require national checks alongside EU rules.

GDPR: the parts that actually apply to a small product

A lawful basis for everything. Consent is one of six bases and usually the weakest choice — it can be withdrawn at any time. Contract necessity covers what you need to deliver the service; legitimate interest covers things like fraud prevention and basic security, but requires you to document a balancing test. Electronic marketing and device tracking have separate rules and exceptions. Special-category data requires both an Article 6 legal basis and an Article 9 condition; explicit consent is one possible condition, not the only one.

Transparency. Your privacy notice must state who you are, what you collect, why, on what basis, who receives it, how long you keep it, whether it leaves the EU and under what safeguard, and how to exercise rights and complain to a supervisory authority.

Rights that work. Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects. Deadline: one month, extendable by two for complex requests. Free of charge.

Data minimization and purpose limitation. Don't collect what you don't need; don't repurpose what you collected for something else. This is the principle AI builders violate most, because generating "a complete user profile form" is easier than generating a minimal one.

Vendor contracts (Article 28). Every processor needs a written agreement. Check the role of each app builder, hosting, database, email, analytics and AI service; some act as independent or joint controllers rather than processors. Check each one publishes a DPA and a subprocessor list, and keep copies.

International transfers. Sending data outside the EU needs a safeguard: an adequacy decision, Standard Contractual Clauses, or — for US-based recipients — certification under the EU–US Data Privacy Framework. Most of the tools you use are American; check what each one relies on.

Records and assessments. Organisations under 250 employees get a narrowed record-keeping duty, but the exceptions swallow it for most products (regular processing, or any special-category data). Keep a simple record anyway; the data inventory from the main checklist is most of it. A DPIA is required for high-risk processing — large-scale profiling, systematic monitoring, sensitive data at scale.

Breach notification. Notify your supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals, and notify affected individuals directly if the risk is high. Decide now who does this and how you'd find out.

A DPO is required only if you're a public body, or your core activities involve large-scale systematic monitoring or large-scale sensitive data. Most small products don't need one — but if you're outside the EU and processing EU data regularly, you may need an EU representative under Article 27.

Cookies and trackers

Device storage and access are governed by national ePrivacy rules alongside the GDPR. Consent is generally needed for non-exempt tracking before it begins. Necessary storage can be exempt, and some countries permit narrowly configured audience measurement without consent. A remote font request is not automatically a cookie: assess the request, personal data and legal basis separately.

For a simple shared implementation, block optional advertising and tracking until consent, make rejection as easy as acceptance, and provide withdrawal. Treat this as a conservative configuration. Do not describe every analytics setup as illegal without consent: CNIL explains the limited audience-measurement exception.

Accessibility: the European Accessibility Act

The EAA has applied to specified products and services, including consumer e-commerce, since 28 June 2025. It does not automatically cover every website. Microenterprises providing services have an exemption: fewer than ten people and annual turnover or annual balance-sheet total not exceeding €2 million, subject to the applicable enterprise definition. Product obligations are different.

Assess the service, national implementation and any exemption. WCAG testing is useful technical evidence, not by itself proof that all EAA information, support and functional requirements are met. See the EU accessibility overview and enterprise-size definition.

If you host user content: the DSA

Classify the service first: intermediary, hosting service, online platform or marketplace. Hosting duties include handling notices of illegal content and providing reasons for relevant restrictions. Platform and marketplace duties have their own scope and small-enterprise exceptions; do not assume every comment box triggers every marketplace obligation.

Prepare contact points, moderation terms and a records-based reporting process. Foreign providers may also need an EU legal representative. Check the relevant articles and exemptions in the Digital Services Act.

The AI Act, in the part that touches you

Article 50 transparency obligations started applying on 2 August 2026. Duties differ for providers and deployers, and for chatbots, synthetic content and public-interest text. A chatbot disclosure is not a substitute for required technical marking; conversely, using AI to help write code does not automatically require a public AI label on the resulting website.

Inventory what the product actually does and whether you provide or deploy the relevant system. Check exceptions and transitional provisions against the Commission’s Article 50 guidance. Do not rely on a generic grace-period claim. Employment, education, credit and other consequential uses require a separate classification review.

If you sell to EU consumers

Before checkout, provide the applicable identity, product, price, delivery and withdrawal information. Where a withdrawal right exists for a covered distance contract concluded through an online interface, an online withdrawal function must be available during that period, with confirmation on a durable medium. National measures apply from 19 June 2026. The right has exceptions; this is not a rule requiring refunds for every digital purchase indefinitely. See Directive 2023/2673.

Immediate digital content and services have different conditions for starting supply and losing withdrawal rights; use the correct flow for what you sell. Keep checkout labels unambiguous about payment and do not preselect paid extras.

Check national identity disclosures and consumer rules. VAT depends on supply, customer and establishment, so do not apply a universal first-sale rule without checking the relevant regime.

France and Spain: the national layer

France. Review business identity and legal notices, consumer sales terms and access to an appropriate consumer mediator, including the required contact details. Do not invent a mediator in a generated policy. See the official mediation guidance and e-commerce obligations.

Spain. Assess LSSI applicability and its provider-information requirements, including identity, contact and applicable registration details. Check cookie choices against current AEPD guidance. See LSSI Articles 2–4, 10 and 22 and AEPD cookie guidance.

These are launch-specific additions, not full national-law surveys. A French translation does not establish Quebec compliance, and a Spanish translation does not establish Mexican or other Latin American compliance.

The EU-specific prompt

Run this after the ten prompts in the main checklist:

Add European Union compliance mechanics to this app. Implement each item and report exactly what changed:

1. Consent gate: no analytics, advertising, chat widget, embedded video, map or third-party font loads before the user chooses. Accept and Reject equally prominent on the first layer, granular categories behind "Manage preferences", nothing pre-selected, and a permanent footer link to change or withdraw consent. Store each consent with a timestamp and the version of the text shown.
2. Audit and list every request the app makes to a third-party domain on first page load, before any consent. This list must be empty except for strictly necessary requests — tell me which ones remain and why.
3. A privacy notice section covering: legal basis for each processing purpose, retention periods, recipients, whether data leaves the EU and under what safeguard, all user rights including the right to complain to a supervisory authority, and our contact details. Use placeholders like [[LEGAL ENTITY]], [[EU REPRESENTATIVE]], [[RETENTION PERIOD]] for anything you cannot know.
4. Self-service rights: export my data, delete my account, correct my profile, and object to marketing — each in at most two clicks, with a log of requests and their dates.
5. An identity page ("Legal notice") reachable from the footer of every page with placeholders for company name, registered address, email, trade register number and VAT number.
6. If the app has any AI feature: a disclosure at the first point of interaction stating the user is interacting with an AI system, and a note stating which provider processes the input.
7. If the app sells to consumers: total price including taxes shown before checkout, a payment button whose label states that ordering creates a payment obligation, the approved consent and acknowledgement flow for immediate digital-content supply, only where the applicable withdrawal exception permits it, and a "Withdraw from contract" function, including a route for guest buyers that opens a confirmation screen with the contract details, completes in one further click, and sends an email acknowledgement.
8. An accessibility pass against WCAG 2.1 Level AA — report findings by severity before fixing.

For each item report PASS or explain what blocked it. Do not write legal claims you cannot verify from the code.
Copy prompt

Pre-launch checklist — EU

• Nothing non-essential loads before consent; reject is as easy as accept; consent is logged
• Privacy notice states legal basis, retention, recipients, transfers and rights
• Vendor roles checked and DPAs collected from processors; subprocessor lists reviewed; transfer safeguard identified for each non-EU tool
• Delete, export and correct all work end to end
• Legal notice / Impressum page with entity details, reachable from every page
• Accessibility audited against WCAG 2.1 AA (or micro-enterprise exemption confirmed in writing)
• AI features disclosed at first interaction
• Selling: withdrawal button live, price with VAT shown, obligation-to-pay button label, digital-content consent checkbox
• User content: notice-and-action mechanism, statements of reasons, contact point
• A written plan for who notifies the authority within 72 hours if there's a breach

What the build checks establish

The prompts are implementation requests, not a legal certification. Two-click controls and consent-first defaults are practical design choices, not universal statutory requirements. Confirm jurisdiction, exceptions, retention and provider contracts separately. Verify controls with test accounts and actual browser/network behaviour; a builder’s PASS based only on code inspection is incomplete evidence.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• EDPB legal bases
• Commission Article 50 guidance

• Commission DSA overview

Start with scope, then implement and test the relevant controls. Run the pre-launch checklist, then the EU prompt above. Selling elsewhere too? Compare with the United States, the United Kingdom, Canada, Australia, Brazil and Israel. You can build this.