Yes, even small websites are subject to GDPR, and enforcement is often triggered by simple, visible issues like improper cookie consent.

Most small sites rely on tools (analytics, ads etc.) that require valid consent to be legal.
It also builds user trust and reduces the risk of complaints or fines.

In practice, it's one of the easiest ways to stay compliant with minimal effort.