GDPR-Compliant Website Analytics

The GDPR does not ban analytics. It regulates personal data, and most analytics tools happen to be built on personal data: persistent cookie IDs, raw IP addresses, and profiles that follow a person across visits. Remove those, and most of the GDPR's machinery no longer bites.

This guide walks through what the regulation actually asks of website measurement and the two realistic ways to satisfy it. It is general information, not legal advice.

What the GDPR regulates

The GDPR applies to processing of personal data: any information relating to an identified or identifiable person. For analytics the relevant examples are:

• Cookie and device IDs. Recital 30 names online identifiers explicitly. A unique ID that singles out one visitor is personal data even without a name attached.
• IP addresses. Treated as personal data by EU case law, since the operator of a site plus an ISP can link them to a person.
• Behavioral profiles. A browsing history tied to any of the above.

Two more pieces sit alongside the GDPR. The ePrivacy Directive (implemented across EU member states, and in the UK as PECR) requires consent before storing or reading anything non-essential on a device, cookies included, regardless of whether the contents are personal data. And since the Schrems II ruling, sending personal data to US-based processors needs extra safeguards, which is what tripped up Google Analytics in decisions by the Austrian, French, and Italian regulators.

Route one: consent

The default answer is to ask. A consent management platform shows a banner, and analytics only fires for visitors who agree. This is legally sound and it is the only lawful route if your measurement genuinely needs personal data, such as cross-device journeys or remarketing audiences.

The costs are real, though. Consent must be freely given, specific, informed, and as easy to refuse as to accept, so the pre-ticked-box tricks are gone. Rejection rates commonly run from 30 to 60 percent, and every rejection is a visitor your dashboard never sees. You are paying for compliance with data quality.

Route two: do not collect personal data

The second route is to measure without personal data at all. If the analytics tool stores nothing on the device, never keeps a raw IP address, and holds no identifier that singles out a person, then there is no personal data processing to legitimize and no device storage to consent to. The banner disappears because the thing it was asking permission for is gone.

This is how cookieless analytics works, and it is the model Analyse is built on. You keep complete traffic numbers, conversion funnels, and source attribution for every visitor, and the GDPR obligations that remain are the ordinary ones: a truthful privacy policy and a processor agreement with your vendor.

The honest limitation: without identifiers you cannot follow one anonymous person across devices or over long periods. If you need that, you are back on route one, asking for consent.

A practical checklist

1. Inventory what your current analytics stores on devices and which identifiers it keeps. Your browser's developer tools show the cookies in a minute.
2. Decide which questions you actually need answered. Most teams need traffic, sources, and funnels, not cross-device ad profiles.
3. Pick the matching route: a consent platform if you truly need personal data, a cookieless tool if you do not.
4. Update your privacy policy, sign a data processing agreement with your vendor, and check where the vendor stores its data.
5. Re-verify yearly. Tools change their behavior, and so does guidance from regulators.

For the tool decision itself, the GA4 comparison and the privacy-first alternatives roundup put the options side by side.