At the point of collection, users are told what data is collected, why, and retention period

GDPR Articles 13 and 14 impose a positive obligation to inform users at the point of data collection — not just in a footer-buried privacy policy. A signup form that submits an email address with no indication of what happens to it, how long it is kept, or why it is needed violates Art. 13(1) on first contact. Cookie banners that present an 'Accept' button without describing which cookies fire or for how long similarly fail Art. 13 and the ePrivacy Directive Art. 5(3). Regulators treat missing point-of-collection notices as independently sanctionable from other violations, not merely as context for other failures.

Add a privacy notice near the submit button of every data-collecting form, linking to the full privacy policy within one click.

<form onSubmit={handleSignup}>
  <input type="email" name="email" required />
  <input type="password" name="password" required />

  {/* Required by GDPR Art. 13 */}
  <p className="text-sm text-muted-foreground mt-3">
    By creating an account, you agree to our{' '}
    <a href="/terms" className="underline">Terms</a>. We collect your email
    to deliver the service (legal basis: contract, Art. 6(1)(b)). We retain
    account data until you delete your account.{' '}
    <a href="/privacy" className="underline">Privacy Policy</a>.
  </p>
  <button type="submit">Create account</button>
</form>

For cookie banners, ensure purpose and retention are visible or reachable in one click from the banner itself — not only in the full privacy policy. Minimum compliant banner text: "Essential cookies run the site. Analytics cookies (2-year retention) help us improve it. Accept all / Manage preferences / Reject non-essential."