Isn't having a privacy policy enough?

A privacy policy describes what you do with data; this tip is about doing less in the first place. The less you collect and keep, the smaller your risk if you're breached and the less there is to explain, secure, and comply with. Minimization is the substance behind the policy.

Does a cookie banner mean I'm compliant?

Only if it actually works. Under ePrivacy and national cookie rules, prior consent is generally required before non-essential cookies or trackers are set, so a banner that loads analytics and ad pixels before the visitor clicks anything is not consent. Where consent is required, withdrawing it must be as easy as giving it — and check what your national law actually requires.

How do third-party embeds affect privacy?

Analytics, social embeds, maps, fonts, and chat widgets can send visitor data, including IP addresses, to their providers, who may act as your processors or, in some cases, as independent or joint controllers. Disclose them as recipients (or categories of recipient); your duties depend on each one's role. Fewer of them means less exposure and usually faster pages.

Do you collect only the data you need — and ask before tracking?

A privacy policy tells people what you do with their data. This tip is about the more powerful move: doing less. Every form field you add, every tracker you embed, and every record you keep is a liability — something to secure, to justify, and to account for if you're ever breached. The most privacy-friendly and lowest-risk data is the data you never collected. This tip sits under security, privacy, and compliance because minimization is where all three overlap.

Collect only what you need

Before adding a field to a form or a tracker to a page, ask what decision or task genuinely requires it.

Trim your forms. Do you really need a phone number, a company name, a date of birth to answer an inquiry? Each extra field is data you must now protect.
Question every tracker. Each analytics tag, pixel, or widget can collect data or hand visitor information to another company. Check what each one actually sends, keep the ones that inform a real decision, and drop the rest.
If you can't name why you're collecting something, don't.

Delete what you no longer need

Data you've stopped using is still data you can lose.

Set retention limits: decide how long inquiries, orders, logs, and accounts are kept — allowing for legal duties (invoices, tax records), security needs, and possible legal claims — then delete or genuinely anonymize them once those purposes expire. (Note: merely masking a name is pseudonymization; the data is still personal.)
Old records that serve no purpose are pure downside: they can be breached but bring no benefit.

Know your third parties

Much of the data your visitors generate never touches your own database — it flows straight to other companies.

Analytics, embeds, maps, fonts, chat widgets, and ad pixels can disclose visitor data — IP addresses, request details, identifiers, device information — to their providers, unless they're self-hosted or proxied. Check what each one actually sends.
Disclose the recipients, or meaningful categories of recipient. Your duties depend on their role: some are processors acting on your instructions, others are independent or joint controllers. You're responsible for making your own disclosure lawful and for the contracts and transparency that relationship needs — not for everything an independent controller later does on its own.
Fewer third parties means less exposure, a simpler compliance story, and, as a bonus, faster pages and lower compliance burden.

Ask before you track (EU)

For visitors in the EU, the rules here come mainly from ePrivacy and its national implementations — separate from the GDPR, which governs any personal data you then process.

Prior consent is generally required before non-essential storage or access such as advertising trackers. Loading analytics or ad pixels the moment the page opens, before the visitor agrees, is not consent, no matter what the banner says. What exactly applies depends on the technology and your national law, so check it.
Strictly necessary cookies generally don't need consent, but the exemption is narrow: the technology must be needed to transmit a communication or to provide a service the visitor expressly asked for. Analytics, advertising, and convenience features don't qualify just because they help the site run.
Going "cookieless" doesn't automatically make you banner-free or compliant — what matters is whether the technology stores or accesses information on the device and processes personal data, not whether it happens to use a cookie.
Give a clear way to refuse non-essential tracking when first asked, and an easily accessible way to change that choice later — withdrawing consent must be as easy as giving it, not a buried setting.

Collect less, keep it for less time, and share it with fewer parties. You'll cut your risk, lighten your compliance load, and speed up your site, all at once.

What to do

Review every form and remove fields you don't genuinely need.
List your trackers and third-party embeds, then drop the ones without a clear purpose.
Set and enforce retention limits — allowing for legal, tax, and security obligations — then delete or genuinely anonymize data once its purpose ends.
Document which third parties receive visitor data, note whether each is a processor or a controller, and disclose them.
Where consent is required, ensure non-essential cookies and trackers only load after it, and make withdrawal just as easy.