Short answer: Squarespace is a compliant processor. It offers a data processing agreement, hosts your data securely, and gives you a built-in cookie banner with regional targeting. Your site is a separate matter — you are the controller.
The gap that catches most Squarespace owners: the native banner governs Squarespace's own analytics and marketing cookies, not third-party scripts you add via code injection. If you pasted in a Meta Pixel or a chat widget, the built-in banner is not controlling it.
Who is responsible for what
GDPR splits obligations between the controller (you — you decide why and how data is processed) and the processor (Squarespace — it processes on your instructions). Almost every Squarespace compliance question resolves once you know which side of that line an item falls on.
| Obligation | Squarespace | You |
|---|---|---|
| Secure hosting and infrastructure | Yes | — |
| Data processing agreement (Art. 28) | Provides it | Must accept it |
| Breach notification to you | Yes | Notify regulators/users if it affects you |
| Cookie banner UI | Built in | Must configure it correctly |
| Blocking third-party scripts | No | Yours |
| Privacy policy for your site | No | Yours |
| Legal basis for each processing activity | No | Yours |
| Marketing consent | No | Yours |
| Responding to data subject requests | Provides export/delete tooling | Yours to answer |
What the native cookie banner does
Squarespace's cookie banner lives under Settings → Cookies & Visitor Data (menu labels shift between versions). It gives you:
- A customisable banner with accept and decline options
- Region targeting, so you can show it only to EEA and UK visitors
- Control over Squarespace Analytics cookies and Squarespace-managed marketing cookies
- A cookie preferences link visitors can return to
Configured properly, that is a legitimate consent mechanism for Squarespace's own cookies. Two settings matter:
- Give decline equal prominence. If "Accept" is a solid button and "Decline" is grey text, you have a dark pattern. EU authorities have issued fines specifically over unequal accept and reject options.
- Do not restrict the banner to the EEA only if you also serve UK or California visitors. UK GDPR and PECR apply to UK visitors; CCPA gives Californians opt-out rights.
The code injection gap
Scripts commonly added this way that set cookies before consent:
- Meta (Facebook) Pixel
- A custom Google Analytics 4 or Google Tag Manager container
- TikTok, Pinterest, LinkedIn and X conversion tags
- Chat widgets — Intercom, Crisp, Tawk.to, Drift
- Hotjar, Clarity and other session recorders, which are especially sensitive because they capture behaviour in detail
- Embedded YouTube, Vimeo and Google Maps iframes
You have three ways to close this:
- Add a consent platform A CMP injected via Code Injection can block the other tags until consent, and gives you consent records. This is the route most Squarespace sites take once they have more than one third-party tag.
- Route everything through Google Tag Manager Then use GTM's consent triggers plus Google Consent Mode v2. More control, more setup, and you still need a banner to feed the signals.
- Remove the trackers Underrated. A cookie-free analytics tool plus no advertising pixels means nothing to block, and the native banner is then sufficient.
iubenda or CookieYes
Both install through Code Injection in a few minutes and block third-party tags before consent. Choose iubenda if you also want a lawyer-vetted privacy policy in the same subscription; choose CookieYes if you only need consent and want a free tier.
Your privacy policy
Squarespace does not write one for you. Squarespace's own privacy policy explains how Squarespace handles data as your provider; it says nothing about your business.
A Squarespace site's policy needs to cover, at minimum: what you collect through forms and commerce, your legal basis for each use, that Squarespace is your hosting processor, any analytics and advertising tools you run, your email platform, international transfers, retention, and how visitors exercise their rights.
Add it as a regular page and link it in the footer on every page. See our comparison of privacy policy generators if you would rather not draft it from scratch.
Forms and mailing lists
Squarespace forms can store submissions, email them, or push them to Google Sheets or Mailchimp. Each destination is a disclosure you must describe in your policy.
- Separate the consents. A contact form asking a question is one purpose. Adding that person to a newsletter is another, and needs its own unticked checkbox.
- No pre-ticked boxes. Invalid under GDPR, full stop.
- Newsletter blocks are marketing. A Squarespace newsletter block feeding Mailchimp needs consent language at the point of signup and a working unsubscribe.
- Storage counts as processing. Form submissions sitting in your Squarespace account indefinitely need a retention decision. Delete old ones.
Squarespace Commerce
If you sell, add these:
- Customer accounts and order records — you can export and delete customer data from the Contacts panel. That is your DSAR tooling.
- Payment processors — Stripe and PayPal are separate controllers or processors depending on the flow. Name them in your policy.
- Abandoned cart emails — marketing. They need a lawful basis, and under the ePrivacy rules the soft opt-in for existing customers is narrower than most people assume.
- Marketing at checkout — must be optional and unticked. You cannot condition the purchase on it.
The same pattern applies on other hosted commerce platforms — see our Shopify GDPR guide. For self-hosted stores, see WordPress and WooCommerce.
Squarespace GDPR checklist
- ☐ Enable the cookie banner and give Accept and Decline equal visual weight
- ☐ Confirm the banner region covers EEA, UK and — if relevant — California
- ☐ List every script in Code Injection and every third-party embed on the site
- ☐ Gate those scripts behind consent with a CMP, or remove them
- ☐ Publish a privacy policy specific to your business and link it site-wide
- ☐ Add unticked, separate marketing consent to every form
- ☐ Set a retention practice for form submissions and order data
- ☐ Configure Google Consent Mode v2 if you run Google Ads or GA4
- ☐ Publish a contact route for data subject requests
- ☐ Re-check with devtools after adding any new integration
Frequently asked questions
Is Squarespace GDPR compliant?
Squarespace is GDPR compliant as a processor — it offers a data processing addendum, hosts data securely, and provides cookie and privacy tools. Your individual site is a separate question. As the controller you are responsible for your privacy policy, your consent setup, any third-party code you add, and responding to data subject requests.
Does the built-in Squarespace cookie banner block cookies?
It controls Squarespace's own analytics and marketing cookies and can restrict them by region. It does not automatically block third-party scripts you add through code injection — Meta Pixel, custom Google Analytics, chat widgets and similar tags will still fire unless you gate them yourself or use a dedicated consent platform.
Does Squarespace provide a privacy policy?
No. Squarespace publishes its own privacy policy covering how it processes data as your service provider, but it does not generate one for your site. You need your own policy describing what your business collects, why, and who it is shared with.
Do I need a DPA with Squarespace?
Yes, and Squarespace provides one. Because Squarespace processes personal data on your behalf, GDPR Article 28 requires a data processing agreement between you and them. Squarespace's DPA is incorporated into its Terms of Service, so accepting the terms puts it in place.
Can I use Google Analytics on Squarespace under GDPR?
Yes, provided you obtain consent before it loads and configure Google Consent Mode v2 for EEA visitors. Because Squarespace's native banner does not block injected scripts, this usually means adding a consent platform. A simpler route is a cookie-free analytics tool, which removes the consent requirement for analytics entirely.
Does Squarespace Commerce handle GDPR for my store?
Partly. Squarespace stores order and customer records securely and lets you export or delete customer data. You remain responsible for marketing consent being separate from checkout, for disclosing your payment and shipping processors in your privacy policy, and for setting a retention practice for order data.