GDPR for online entrepreneurs - 5 Step Guide - 015
In this solo episode of Law and Wit, attorney‑entrepreneur Brittany Ratelle walks creative online business owners through a practical five‑step plan to achieve compliance with the EU General Data Protection Regulation (GDPR). She explains why the regulation matters to U.S.‑based entrepreneurs—because the internet makes any interaction with EU residents subject to GDPR—and outlines the financial stakes (fines up to 4 % of annual revenue or €20 million). The five steps are: (1) Screen and segment EU users in your email list, using IP‑based tools or treating unknown contacts as EU; (2) Obtain clear, affirmative consent from existing EU contacts, re‑engaging them with a dedicated opt‑in request; (3) Build consent mechanisms for future sign‑ups (checkboxes, “sandwich” pages, or explicit opt‑in links) ensuring no pre‑checked boxes; (4) Update your website’s privacy policy with GDPR‑compliant language, disclose all data collection (including analytics, pixels, cookies), and adjust child‑age rules to under‑16; (5) Prepare to honor data‑subject rights—right to access, right to be forgotten, breach notification within 72 hours—and have a response plan. Ratelle peppers the guide with practical tips, tool recommendations (e.g., ConvertKit segmentation), resource links (Amy Porterfield/Bobby Clink episode), and encouragement to seek help from email service providers or switch if they don’t support GDPR. She ends with a call to download a checklist from the show notes and invites listeners to join her email list and live Q&A.
Chapters
This is episode 15 of Law and Wit: GDPR for Online Entrepreneurs, a 5-step guide. Welcome to Law and Wit, Creative Counsel for Entrepreneurs. I'm your host, Brittany Ratelle, mother of 4, entrepreneur, naptime lawyer, and attorney for creative entrepreneurs. I'm here to share inspiration and action so that you can tackle your business blocks and confidently own your business in every sense of the word. Thank you so much. For being here. Hello everybody and welcome back. And I'm here to talk about the super sexy and exciting world of the GDPR. No, it's, it's not, guys. I mean, I frankly, I feel like I have to apologize for my subject matter a lot. I feel like that's just the role that I have been dealt. That is the hand, it's the hand that I've been dealt. That's the role I have to play, is to apologize for my boring subject matter. And today I is no exception to that. In fact, it's probably one of the more denser and more scary things out there in terms of regulation. But look, I've, I've looked at this a lot. I've read a lot of stuff, distilled a lot of things, and I am promising you that I am making this the most manageable, bite-sized, actionable plan that you're going to get on this stuff. Okay, so today we have a 5-step guide so that you can wrap your eyes and ears and entrepreneur brains around the GDPR, which if you're not familiar is the General Data Protection Regulation that is coming out of the EU. Now I know what you're saying, Brittany, I am an American and you are an American and why are we giving a flying fig about what is happening in the EU? And the reason is the internet, my friends. If you aren't aware, people exchange goods and services on the internet pretty freely over borders, including from the EU. And this particular set of regulations, which goes live on May 25th, 2018, year of our Lord, affects and says that basically anyone who is doing business with someone who is a resident in the EU, not even a citizen, you do not even have to have an EU citizenship card. It could even be someone who just happens to be in the EU at that time that you are connecting with, which You know, talking all those laptop warriors who are bragging on their Instagram that like, oh, I'm working from Paris. I'm, you know, I'm taking my sabbatical. You know, those people, those schmucks, that's who we have to be dealing with. So, um, so it applies to you guys is what I'm telling you. The chances are is that you have someone on your email list or someone that you have sold something to, even if you don't sell products from your website, even if you only sell information, like on an email list, like a freebie, like we all have been counseled to do to try to get people on our email list, it's likely that you are dealing with someone in the EU. So that's why this matters, guys. That's why you gotta care. So, so there you go. So here are the 5 steps. And the other reason why is because there are beaucoup fines. So to drop a little French on you, if you have a problem with this, I'm talking in the neighborhood of that you can be fined up to 4% of your annual revenue or €20 million. For a fine. Now I understand that it's unlikely that anyone is going to be hitting you with that fine right out of the gate. That fine is probably going to be reserved for our big players here, you know, our major companies, data processors who are dealing with a lot of people's data and perhaps doing it in shadier ways. However, that's not to say that you couldn't be at risk for some sort of fine or some sort of censure. And certainly if you are planning on growing your company and doing more with data and privacy and being able to move forward, you want to be confident that you're not going to have a problem. So we're going to talk about how we make that happen. So, okay, number 1, uh, your first step is to screen EU users that you might have, uh, that are coming across your website and using your services, that you might have their data. Um, so the way that you're going to do this is you're going to find out which contacts on your email list are from the EU. Um, Now, uh, you may— most of the major email providers I know, for example, I use ConvertKit, so that's one that I can speak of. Um, I know that they are trying to roll out segmentation, um, right now to give you a heads up that you can actually screen out and figure out which of your users might be from the EU. They're trying to do that by IP address. So, um, the easiest way is that you have a tool like that, that your email manager is robust and is on, is on top of this, that they can actually tell you who's on your list from the EU. Um, If you can't, for whatever reason, either you don't have that data or you've been using some like freebie service and just inching along and now you're not sure what you know, then you pretty much have to treat those unknown email addresses as if they were from the EU. Because when in doubt, pretend like they are from the EU. You know, um, that's, that's, that doesn't rhyme, but that's what you have to do. Okay. Just to be safe, better safe than sorry. Okay. So first is screening segmentation, find out who's from the EU. Second is you are going to need to get consent from those EU users, um, to be on your email list. So if you're— and that's because the EU, the GDPR, um, one of the promises and one of the things it's rolling out is that it's saying you have the right, um, as a person to have someone have to ask your consent to get your email address and to access and have your personal data. And that includes things like your address, your name, your IP address, your email, certainly, you know, anything else that could be personally identifiable, especially anything else that's more sensitive information, you know, genetic information, healthcare information, things about pregnancy status, sexual orientation, religious disability, certainly all of those. Now I know most people don't collect that kind of information. So I'm going to assume you don't— are dealing with that kind of sensitive information. But it's a pretty safe bet that you are asking about someone's email because you probably want them on your list because we've all been told the money's in the list. Get them on a list, get the list however you need to. So that's great. But now you have this ticking time bomb list of people. So we need first— our first step was to screen who's EU on that list. Second step is to get consent from those EU users. Okay, so if you are at all unsure if when you added those people to your list, if they— if it wasn't crystal, crystal clear that they were getting added to your general email newsletter marketing list, then you need to get consent from them. Now I know what you're saying, Brittany, like, hey, I had a little, you know, thing on my form that said, um, get my freebie and get added to my list. Isn't that clear? Um, the jury is not quite out on this. In fact, a lot of attorneys, um, uh, that I've been consulting with and listening to think that if you were giving away a freebie, um, that it's not very clear because you were kind of tying and mingling those things together. You were saying, hey, I'm gonna give you this thing that has a lot of value, you really want it, it's super sexy and cool, and by the way, I'm going to add you to my list. It's kind of like one of those, like, you know, mortgage commercials where they just add in all the terms at the end. So, um, if this is possibly what you were doing, then you need to assume that you do not have consent from these people. And what I suggest you do is that you start sending out some emails to those people, those EU people or possible EU people, asking to re-engage and asking for their affirmative consent clearly and concisely to say, please, please, will you continue to play with me? Will you consent to be added to my email marketing list? And you need to probably phrase it very similar to that, okay? Don't try to sugarcoat it or say like, oh, just be added for my, you know, for this purposes, or so I could get more like value. I mean, you really just need to make it very clear of what you do with this list. If you sell from this list, then you need to be clear about that. Okay, if this is a marketing list, that, that's exactly what it does, then don't try to call it something else. Okay, you know, you can add value, talk about what people get out of this, you know, do you give people exclusive discount codes? Do you give them access to know, you know, all I know, a lot of newsletters people use to say like, oh, we're dropping new product on midnight to Is anyone actually doing that, staying up to like buy new product? I don't know anyone who does that, but apparently it's happening because sometimes things are sold out. But anyway, if you're doing that kind of thing, then yeah, tout that. Make a little video or audio clip and personalize it. Talk about why your list is so cool and you want to be on it. But make it clear that that is what you are asking them to do, okay? So you need to get consent. And ideally, you would have a way for them to click. Either a new little lead page that's exactly for that purpose, that's your EU re-engagement page that you create, or some click in an email, some link that says, please click here if you want to be added or stay on my newsletter list. Otherwise, after this date, and I would give yourself at least a couple days before the 25th deadline of May, so by May 20th or May 23rd at the latest, if you haven't clicked this, You are out of here. I am dropping you from my list. This is the last call for alcohol people, okay? All right, so after you've done that, which I know sounds— it sucks, it sucks, guys, but, well, I, you know, there's nothing else to tell you. That's just where we are, okay? Step number 3 is you need to get consent and set up some new consent procedures for your new people. So this is, you know, looking forward to what are you gonna do after May 25th. Might as well put this stuff in place, okay? Um, one way that is recommended that you can do this is that you can add a checkbox to your opt-in or lead magnet just to people from the EU. If there's a way that you can segment people from your website, that's super sweet because then that will only show up to people from the EU and you're not giving that option to everybody. If that's not an option, then you may need to wait and do a step later on in your process, in your funnel, so that you're not unnecessarily giving people options out of your list. So you kind of have to look a little bit at your tech and what you have in options, and that may depend on the sophistication of your email provider, your— if you're using LeadPages or other opt-in boxes and forms and other widgets and plugins, all those different companies that are speaking together that are trying to get your people's stuff. So the main thing here is that you cannot do any kind of bait and switch or pre-checked box here. So if you have a checkbox and that says, please, you know, add me to your email list, you cannot precheck this for people or instruct your web developer to do that. Okay? People have to voluntarily, like a real human being, reach up with their mouse and click it. Okay? Like, you know, God touching Adam in the famous painting. Okay? On the Sistine Chapel. That is what must happen here. Okay? A human being has to have an honest voluntary movement to say, yes, I want to be on your list. All dramatically, just like that, okay? If that's not an option for you in terms of segmentation, then another option you can have is an opt-in page. You could have just on your opt-in page, you can have that as an option and say, here I want you to add onto my list. And this can be like an in-between page. Maybe it's after someone asks for your freebie, but before they get to like the thank you, here's what you're gonna love about it, you're gonna love being part of our team, whatever, whatever. Maybe you— and some people have called this like a sandwich page in between here. I think Bobby Clink said that on Amy Porterfield's podcast, which if you haven't— if you don't listen to Amy Porterfield, she is, you know, the email list queen. And so if you want more specific information about how to implement this and the attorney that she had on and his take, I would highly recommend that episode. So look for that, Amy Porterfield and Bobby Clink. And so that's one that they recommended is doing like a sandwich in-between page. Another option is in your delivery email. So someone clicks on They want your freebie, you send them their freebie, it ends up in their email box, you know, they open that email that says, thanks so much for confirming, here's your thing. By the way, you might also, while you're here, I'm pretty cool, you might also want to get added onto my email list. And here's a great time to sell. And again, use some of your same magic that you were using before to get your people to stay on your list. Talk about why is your list so cool? Why would they want to stick around? Or what are you delivering? Is it value? Is it entertainment? Is it money saving, time saving? Is it exclusive content? Whatever it is that makes your email list sexy and cool, sell, sell, sell, sell that there. And again, but make sure that it's a voluntary freebie opt-in, not any kind of pre-checked thing that they have to be checking on their own. So, and the last thing is in the lead magnet itself, you possibly have some sort of link that someone has to click back in or say like, yeah, I want to be added to my list or, and you know, but again, it has to be something that they are taking action on their own. So, and again, these are all ways to handle new subscribers if they could possibly be from the EU, or you either know they're from the EU or you can't tell, and so you kind of have to err on the side of caution. So, obviously because of this and because of the way it's going to change, it's likely that a lot of our email providers and people who are providing these kinds of services are going to be stepping up to the plate and trying to offer more segmentation and being able to to show where your people are from because I'm sure you like me, I am not really interested in giving away a lot of freebies and opt-ins without people joining my list. That's kind of the whole point. I mean, I'm all for providing value but I also need your email address. Like, let's be real here. I can't do what I do and I can't contact you when and if I want to contact you if I don't have that email address. You know, I'm at the mercy of all the other platforms and their algorithms and their policies. So, okay, so that's a big number 3. I know a lot to follow, but I know that email marketing is so important and that's likely the biggest area and touchpoint that everyone is going to have with the GDPR is how they handle their email marketing. So if you have any questions about this, I'd advise you to reach out to whoever is your email service provider. It's likely that they have a frequently asked question or they're doing some sort of training or they have information in their support or knowledge base. So reach out and see what are they doing to offer you as a consumer of their products. And if they're kind of leaving you in the dust, if they're not helping you with some of this stuff and some of these options and tech, then maybe it's time to switch, people. Okay, number 4 is you need to update your privacy policy on your website. So if you don't have a privacy policy, eh, that's a wrong answer, guys. You need to get one, okay? I don't like to be judgy on here, and I'm not being judgy, but I'm just telling you the straight truth. It's time. You need to have a privacy policy, okay? California requires one. You probably are dealing with people in California. Now the EU is requiring it, so just get on it, okay? Just suck it up and write it and put it on your website. It needs to be in your footer. It needs to be a standalone page, one, a page for your privacy policy and a page for your terms of service or terms of use, okay? You can call it either one, but your privacy policy also needs to have kind of new GDPR-compliant language. Um, and I'm creating some texts like this. So if you guys need some of this, um, uh, you want to make sure that you are on my email list because I'm going to be sending this out to my email list subscribers. Okay. So if you're not already a client of mine, um, or on my email list, then you might be left in the lurch. So make sure you're getting on my list. Okay. BrittanyRatelle.com/newsletter. Or, um, you can also, you're going to be able to get on the list from the episode notes from this episode, which will be BrittanyRatelle.com/15, as in episode 15. So go to either of those places and you're going to be able to get on my list and you're going to be able to get that text to update your privacy policy. Okay? And what your privacy policy needs to say is it needs to not be shady. It needs to be clear and understandable, no hard to understand legalese. Okay? And it needs to state stuff of how and explain how you are going to comply. You need to talk about what are you collecting from people who come onto your webpage, what information, what are you collecting and what are you doing with it? That's the essence. And I know that sounds really simple and you're like, well, I'm not collecting anything and I'm not doing anything with it. I beg to differ. I'm going to call BS on you because it's likely that you are running Google Analytics. Okay. And guess what? Google Analytics collects information from people. That's how, that's how, that's the analyze in the analytics. Okay. They are analyzing stuff. They are looking at what devices are people on, they are tracking where they are coming from, they are tracking how long they're staying on your site, and if they're putting in any information, they are tracking that, okay? If you are using LeadPages or email marketing managers like we've talked about, then you are collecting information. If you have Facebook pixels on your website, you're collecting information, okay? Cookies, if you're participating with affiliate networks who all have to keep track of where people are and how long and if they bought, in a certain time period, whether in that cookie window, then you are collecting information, okay? So yeah, the answer is yes, you are collecting information, but you need to understand what you are. So talk to your web developer, talk to your advertising people, or if that's you, if you are wearing all those hats, then be a little introspective about what are you collecting from people and why, and is this actually information that you need to be— are you unnecessarily collecting stuff that you don't really need that you're putting yourself at risk? Some other things that the GDPR codifies that are kind of newer that need to be considered is that customers can have, have the right to be forgotten, basically. It's a right saying that someone can contact you and not only can they ask and say, "Hey, I want a copy of all the information you have on me that you've collected from your website," and you need to provide that, someone can also say, "Hey, I am exercising my right to be forgotten and I want you to delete everything." in which case you need to delete everything on them. So, and that means you'll need to delete it on wherever you store that information and any of those other vendors or service providers that you use. So contact your email people and your Leadpages and whatever else you use, make sure that their information is not being stored anywhere else remotely or through a third-party app, okay? The other thing is, like I said, don't collect more information or data than you need. You're just opening yourself up to liability and risk and you're not, getting anything out of it. So, um, and make sure that the GDPR, um, redefines children as anyone under 16. We're all pretty familiar with the COPPA law in the US that says that you have some extra burdens if you are doing any marketing or, um, that you're advertising to children under the age of 13. So a lot of us have those in their privacy policies. The GDPR bumps that up to 16. That says if you are connecting or storing anyone's information, private information from anyone who's a child under the age of 16, then you need consent from their guardian or age verification. So, um, that's a good idea. So if that says 13 in your privacy policy, change that to 16, okay? And if you do have content that's aimed at kids, if that's part of what you do, you know, if you are having toy tutorials or hairstyling or something else where you know, um, you know that kids are watching it and you are— your content is aimed at children, then we need to talk. Okay? Because there's some other things that you need to be doing to protect yourself. Because anytime you're dealing with private information of children and interacting with children, you have a lot more burdens anyway that come on you as a service provider. So, okay, so that's the big number 4 is update your privacy policy and make sure you put your updated date on there. And I would send out a link to anyone who's an email subscriber or a customer and say, "Hey, by the way, we have updated our privacy policy and here's the link for that." So, yeah, I know no one's going to read it, but it's a good practice to have is that you will update people when you change the terms so that they're aware when they're interacting and coming onto your site or using your services. Okay, the last is that B, be prepared to delete data. And we kind of already talked about this, but if a user reaches out and requests to your vendor or anyone else that they want their data deleted, that you need to be able to deliver on that promise. And the other thing is that if you have any kind of data breach that happens, you need to respond within 72 hours. Those are serious responsibilities. A data breach is a big deal, and that you need to notify your customers and have some sort of plan in place of how you're going to mitigate the damages and try to fix it. So moral of the story is, if you have a data breach, you cannot just sit on it and be like, woe is me, this sucks. Like, you need to have a plan. So you probably need to have someone already on your Rolodex of who, you know, who you're gonna call. Ghostbusters, I'm sorry, um, came to mind. But have a plan of, you know, do you have someone who can help with that kind of issue? Especially as we talked about, if you have more data than less, you know, if you've— if you have a giant email list then that's gonna be a bigger deal. So let's make sure we're on that. If you collect a lot of information because you use forms or quizzes or other things in your community element that collects information from people, then let's make sure that we have a plan in case any of that gets hacked or breached. Okay, all right, okay, those are the 5 steps, guys. I know that's a lot of dense stuff I threw at you, and I'm not trying to scare you, okay? That's never what I'm trying to do, is trying to scare you or overwhelm you. But I am trying to serve you and bring your attention to important issues that are going on in your business. And I want you to know that even if you think that like, I am just a little, I'm just a little shop, Brittany, like I, I just do this online. Or maybe you don't even sell anything from your website. All you do is you want to get people on your email list because you want to do something else with that. You maybe want to sell stuff down the road, or you have an online course, or you do in-person events or, you know, the hundreds of other business things that you do. You're a photographer, but you know, if someone's interested in getting on your next mini shoots, then you want their name. Okay. This is what I'm talking about, that you're collecting data because you're collecting people's email addresses. So just be aware that this actually applies to you even though you think it may not. Um, but if you follow what we've talked about today and go through these 5 steps, um, you, you're going to be okay. All right. Like I said, I'm gonna have this up in a little guide in the show notes. So if you listen to this and are like, yeah, this went all over my head and now I'm sweating bullets, thanks a lot, Britt, for ruining my day, then jump on over to the show notes, download the little checklist that comes with this, and it's gonna walk you through. I'm gonna hold your hand, okay, so that we can get on top of this thing and feel better and more confident as business owners, okay, as online entrepreneurs, citizens of the world, you know, congratulations, we get to be affected by, um, cruddy stuff that they pull in the EU. Okay, that is unfortunately, that's the world that we live in, you know. No, no, no borders, not on the interweb. So, okay, um, if you, uh, if you get the link to the show notes, it's going to be BrittanyRatelle.com/15. Um, if you want to be added to my list, which is my email marketing list, Full disclosure, although I've yet to sell anything on there, but I probably will someday. But I do give tips and tricks, and that's why it's useful to be on my email list. I give the links to my YouTube replays of my online Q&As that I do every Monday night on Instagram and Facebook. You can hop on. If you haven't joined in for one of those, get on it. It's at 9 PM Mountain Standard Time, and you're able to jump on and ask any questions that you want. I'm on there for usually like 20 minutes,. And you can ask any kind of creative entrepreneur, small business, indie entrepreneur, however you identify yourself. There's a thousand names for you people, which is why it makes it hard for me to niche. Everyone keeps telling me to niche down, but I'm like, yeah, that would be helpful if people had a working, you know, a reasonable nomenclature of how to define themselves. But, uh, you know, people are all over the map, which is fine. You guys, you do you and I'll do me, and I'm just here to help you. So, okay, that's a long-winded way of saying that. Thank you guys so much for leaving reviews, those of you who've left reviews. I read every single one and I really appreciate it. I'd love to get like up to 30 reviews. I'm only like at like 20-something, so, you know, if only a couple of you, just a handful of you who I know are listening to this because I'm checking the stats and are finding this useful and are sharing with your friends and posting about it and sending me DMs, which is all super, super nice. I love the love and feedback. I really appreciate it. If a couple of you would just post a review on iTunes, I'd really, really appreciate it. Okay? Be my new BFF. So thanks so much for being here, guys, listening. Let me be part of your day, folding laundry, driving, driving kids to and fro, jogging, walking, whatever it is you're doing. I really appreciate it. So thanks a lot, and I'll see you on the flip side.
More from Brittany
174: Getting Legally Legit with Brittany Ratelle: Essential Legal Tips for Fitness Professionals...
New Freelancer Law Gives Superpowers to Small Service Providers | #freelancers #gigwork
