Someone on the committee adds an Instagram feed to the home page. It looks lively, it took ten minutes, and it cost nothing. From that moment, every visitor to your site is also announced to Meta, usually as soon as the page loads, and whether or not they have an Instagram account. Your group has started handing visitor data to one of the world’s largest advertising companies. Nobody decided to do that. It just came in the box.
This isn’t a scare story, and it isn’t an argument against using online tools. Most of what small groups use is reasonable, and some of it is run with real care. But almost nothing online is free of strings. The strings land on the group that adds the tool, not on the company that supplies it. This article is about seeing those strings before you tie them, because for a small volunteer-run organisation, they come back as admin.
Three strands, two questions
UK data protection law feels like one tangle. It is easier to handle as three strands that answer two different questions.
Question one: how may you handle personal data?
- UK GDPR sets the principles. Collect only what you need, for a stated purpose, with a lawful reason, keep it safe, and don’t keep it forever. It also gives people rights over their data, such as seeing it, correcting it, and having it deleted.
- The Data Protection Act 2018 adapts UK GDPR for British use. It adds exemptions, gives the Information Commissioner’s Office (ICO) its powers, and sits behind the annual data protection fee most organisations pay.
Question two: what may you put on someone’s device, and what may you send them?
- PECR (the Privacy and Electronic Communications Regulations) covers cookies and similar tracking on your website, and marketing by email, text and phone. It is older than GDPR and applies separately. You can obey GDPR perfectly and still break PECR.
The Data (Use and Access) Act 2025 has amended all three, in places easing the rules for charities and for low-risk cookies. It didn’t replace them.
The common mistake is to merge the two questions. “They gave us their email, so we can send them anything” answers question one and ignores question two.
“We have a cookie banner, so we’re GDPR-compliant” answers question two and ignores question one. A group needs both answers.
Every service collects something
No internet service can work without learning something about the people who use it. To send a map tile or a video to a browser, the server needs that browser’s IP address. Most services also log which device and browser asked, which page it came from, and when. Much of this is legitimate and necessary: spotting attacks, fixing faults, working out which servers are overloaded, and improving the product.
The question is what happens next. Some services use that data to keep the service running, and nothing more. Others combine it with what they learn elsewhere: across millions of websites that carry their buttons, feeds and trackers, and from data bought from third parties. From that they can build a picture of a person’s interests, movements and habits, and sell access to it. A single embed on a community group’s page is a small contribution to that picture. It is not nothing.
You can’t read every privacy policy, and you don’t need to. There is a quicker test: how does this service pay for itself? The answer predicts, roughly, what it does with what it collects.
| How it is paid for | Examples | What to expect |
|---|---|---|
| Advertising | Google Maps, YouTube, Facebook and Instagram feeds | Your visitors’ data feeds an advertising business. Expect tracking and cookies, and assume the data travels well beyond your site. |
| Subscriptions from customers | Mailchimp, ArcGIS Online maps (often published by councils and developers), Dropbox | You are the customer. Data is mainly used to run and improve the product, but analytics and some sharing with partners are common. Read the small print. |
| Volunteers, donations or public funds | OpenStreetMap, uMap, Wikipedia | Usually minimal collection and no monetisation. They still see IP addresses, and their capacity is limited, so heavy use can be a burden on them. |
This is a rule of thumb, not a verdict. Paid services can behave badly, and free ones can behave well. But “free, and run by a company with shareholders or technocrats” should always prompt the question of who is really paying.
The tail on every embed
Here is the part that tends to surprise committees. When your website loads someone else’s content, the law treats your group as jointly responsible for what that triggers, at least up to the point where the data leaves your page. “It’s their service” isn’t a defence. In practice, each integration brings its own tail of admin:
- The cookie banner has to know about it, describe it, and block it until the visitor agrees. Banner tools recognise the big names but often miss smaller ones, so someone has to check.
- The privacy notice has to mention it, say what data goes where, and note that it probably leaves the UK.
- People’s rights extend into it. If someone asks what you hold about them, that includes data sitting in the mailing service, the booking tool and the shared drive.
- It changes without telling you. Services update their terms, add tracking, get bought, or close. Somebody needs to notice.
- It outlives the person who added it. The committee member who set it up moves on, and the account goes with them. Nobody else knows the password, or that the thing is there at all.
None of these items is hard on its own. Together, multiplied by every feed, widget and plug-in, they add up to a real load for a group run by volunteers in their spare time. Often the people who carry it are not the people who chose the tool.
That is the hidden cost of the “singing and dancing” website. Each extra looks free on the day it goes in. The bill arrives later, as admin, and it arrives with you.
Four questions before you add anything
Before anything new goes on the site, ask:
- Would a link do? A plain link sends nothing until the visitor chooses to click. A screenshot saved on your own site, linking to the live map or feed, gives you most of the look with none of the strings.
- How does it pay for itself? If the honest answer is advertising, think twice.
- What does it send, and to whom? If nobody on the committee can answer that, you aren’t ready to add it.
- Who will look after it? Name a person, and have a plan for when they step down.
None of this means going without. It means choosing deliberately, and keeping the website as simple as your volunteers can actually manage. A plainer site that you understand is worth more than a busy one that you don’t.
If you want to see where your group stands now, the Self-Check alongside this article takes about half an hour for two committee members. It covers what data you hold, where it actually lives, and what your web host needs to know. Most groups find at least one thing worth fixing, and it is rarely on the website itself.