You built the website with AI. It works, it looks right, and the tool may even have produced a page called "Privacy policy". The question is whether that page describes your website, and whether you need a cookie banner at all. This post answers both in plain language, for a website run from Denmark, with an example you can start from.
We are not lawyers. This is what we check ourselves when we take a customer's website live, and what the Danish Data Protection Agency (Datatilsynet) and the Danish Agency for Digital Government (Digitaliseringsstyrelsen) write in their joint guidance. If you are unsure about something specific, ask an adviser.
Does your website need a privacy policy?
Yes, if it processes personal data, and almost every website does. A contact form, a login, a newsletter, an order, visitor statistics: all of it is personal data under GDPR. As soon as you collect anything about a person, you have a duty to inform them: what you collect, why, and what they can do about it. The privacy policy is where you say so.
A pure business-card website with no form, no login and no statistics can in principle make do with a couple of lines about server logs and hosting, because even that site keeps IP addresses in its logs. The day you add a contact form, it is no longer pure.
Privacy policy example: the nine things it has to say
GDPR's article 13 lists what you have to tell people. Here is that list in the words you can use on your own page:
- Who is responsible. Your company name, business registration number (CVR in Denmark), address and an email address that someone reads. If you have a data protection officer, their contact details too; few small companies do.
- What you collect. Name, email, phone, what people type into the form, IP address, login details. Write what your website actually stores, not a generic list.
- What you use it for. Answering enquiries, delivering what the customer ordered, sending the newsletter, improving the website.
- What allows you to. Usually "the agreement with you", "our legitimate interest in …" or "your consent". Consent has to be as easy to withdraw as it was to give.
- Who else sees the data. Your hosting provider, your email service, your payment provider, your statistics tool, and whether any of them is outside the EU.
- How long you keep it. A period or a rule: "until the case is closed", "five years after the end of the financial year the purchase belongs to, as the Bookkeeping Act requires".
- What rights the person has. Access, correction, deletion, restriction, portability and objection, and how to use them (write to the address in point 1).
- That they can complain to the Data Protection Agency, with a link to datatilsynet.dk.
- Whether you make automated decisions or profile people. For most small websites: no. Say so anyway.
Here is what points 2 to 6 can look like for a contact form:
When you write to us through the contact form, we store your name, your email address and what you write. We use it to answer you and to follow up on your enquiry. The basis is our legitimate interest in answering enquiries (GDPR article 6(1)(f)). The form is sent through [email service], which processes the data on our behalf [in the EU / in the USA under the EU's standard contractual clauses; check which applies to your service]. We keep the enquiry for up to 12 months unless it leads to an agreement.
Write the rest the same way: one paragraph per place where the website collects something. That beats a page that covers everything a website could possibly do.
Cookies and the cookie banner: when do you have to ask?
The cookie rules are a different law from GDPR (in Denmark the cookie order, supervised by the Agency for Digital Government), but the answer is simple. You may set cookies, or anything that works like them such as pixels and local browser storage, without asking only when they are necessary for the website to work. That is the cookie that keeps you logged in, or the one that remembers your basket. Everything else needs consent before the cookie is set: statistics, marketing, embedded videos, maps and chat widgets.
Consent has to be an active choice. A banner that says "by using this site you accept cookies" is not consent. Saying no has to be as easy as saying yes, people have to be able to see which cookies and for what, and they have to be able to change their mind later. The Data Protection Agency and the Agency for Digital Government published joint guidance on cookies in May 2025 that covers both the banner and the consent; it is written for owners, not lawyers.
So: if your website only has login and basket cookies, you do not need a banner, but you still mention cookies in the privacy policy. If it has statistics or anything embedded, you need a banner, and it has to hold the cookies back until someone has said yes.
Datatilsynet and Digitaliseringsstyrelsen: who watches what
The Data Protection Agency supervises GDPR: the privacy policy, people's rights and how you handle the data. The Agency for Digital Government supervises the cookie rules (it was the Business Authority until December 2022, so older articles still say so). In practice they meet in the cookie banner: what gets set is the Agency for Digital Government's concern, what happens to the data afterwards is the Data Protection Agency's. That is also why a cookie banner and a privacy policy do not replace each other.
What the AI tool writes, and what you have to fix yourself
Ask Lovable, ChatGPT or another tool for a privacy policy and you get one. It reads well, looks right and describes what a typical website does. Three things usually go wrong:
- It lists things your website does not do ("we use Google Analytics", "we share data with our partners") and misses what it actually does, such as the AI service the form sends to.
- It does not name the services the tool itself connected: where the database lives, who sends the email, where files are stored. Those are exactly the recipients point 5 is about.
- It adds a cookie banner that looks right but holds nothing back. The cookies are set before anyone has answered.
That is not the tool's fault. It does not know what your website does until you tell it. So ask it directly: "List every service this website sends data to, and which data." That list is the raw material for points 2 and 5.
Checklist before you publish
- The privacy policy describes your website, point by point, not a typical one.
- Company name, registration number and an email address someone reads are at the top.
- Every service the website sends data to is named, and you know whether it is in the EU.
- The Data Protection Agency is named as the place to complain.
- Only necessary cookies are set before someone says yes, and no is as easy as yes.
- You can find the place where a visitor changes their cookie choice.
- The page is linked from the bottom of every page.
- And while you are at it: the five things to check before you share your website.
If this is more than you want to deal with, it is part of what we do when we take a website live: we find the services the website talks to, write the privacy policy to match them, and set up a cookie banner that does what it says. It belongs to the launch, and it starts with a free 25-minute check.