GDPR and web analytics: the basics
The General Data Protection Regulation (GDPR) doesn't ban website analytics. It regulates how you collect and process personal data. Understanding the difference between what's required and what's myth is crucial.
What counts as personal data in analytics?
Under GDPR, personal data includes any information that can identify a person, directly or indirectly:
- IP addresses — Yes, even truncated IPs can be personal data
- Cookie identifiers — Unique tracking cookies are personal data
- Device fingerprints — Combinations of browser, OS, screen size that uniquely identify users
- User IDs — Any identifier tied to a user account
What's generally NOT personal data:
- Aggregate page view counts
- Anonymous session data (when truly anonymous)
- General geographic data (country/region level)
The consent question
The biggest misconception: "All analytics require cookie consent."
Reality: Consent is required when you:
- Use cookies or local storage for tracking
- Collect personal data (like full IP addresses)
- Share data with third parties
- Track users across websites
Consent may NOT be required when:
- Your analytics tool doesn't use cookies
- No personal data is stored
- Data is processed server-side and anonymized before storage
- You have a legitimate interest (but this is legally nuanced)
Practical steps for compliance
1. Choose the right tool
Select an analytics platform that minimizes personal data collection by design. Look for:
- No cookie-based tracking option
- IP anonymization
- EU data storage
- Clear data processing agreement (DPA)
2. Update your privacy policy
Even with privacy-friendly analytics, you must disclose:
- What data you collect
- Why you collect it (purpose)
- How long you keep it (retention period)
- Who processes it (your analytics provider)
- How users can exercise their rights
3. Implement consent if needed
If your analytics tool uses cookies, implement a proper consent banner that:
- Doesn't use pre-checked boxes
- Allows granular choices (not just "accept all")
- Works before any tracking fires
- Remembers the user's choice
4. Sign a Data Processing Agreement
If your analytics provider processes personal data on your behalf, you need a DPA in place. Most reputable providers offer this as standard.
5. Set appropriate data retention
Don't keep data longer than necessary. A retention period of 14-26 months is standard for analytics data. Configure auto-deletion in your tool.
Common mistakes to avoid
1. "We're too small for GDPR" — GDPR applies to any business that processes data of EU residents, regardless of company size
2. "Our developer said we're compliant" — Compliance is a legal question, not a technical one. Get proper legal advice
3. "We use analytics, so we need a cookie banner" — Not necessarily. It depends on the specific tool and configuration
4. "Anonymized data = no rules" — True anonymization is hard. If data can be re-identified, GDPR still applies
The practical approach
For most small to medium businesses, the simplest path to compliance:
1. Use a privacy-friendly analytics tool that minimizes data collection
2. Write a clear privacy policy
3. If cookies are needed, implement proper consent
4. Sign DPAs with your providers
5. Document your decisions (accountability principle)
Conclusion
GDPR compliance for analytics isn't as scary as it seems. The key is choosing the right tools and being transparent about your data practices. Privacy-friendly analytics platforms make compliance easier by design — less data collected means less to worry about.