GDPR Compliant Analytics: What It Takes, and What to Pick

A person sits at a desk in a small home office, typing on a laptop viewed from behind, with a mug and a potted plant next to the keyboard.

GDPR compliant analytics means your measurement avoids personal data or processes it under a lawful basis you can document and defend. In practice that means no cookies, hashed or discarded IP addresses, and data kept off servers where a third party can use it for its own purposes. A tool can be compliant and still useless, so check what it counts before you check its legal page.

TL;DR:

  • GDPR and ePrivacy are separate tests. Passing one does not pass the other.
  • Cookies set before consent breach ePrivacy Article 5(3), whatever they store.
  • US sites fall under GDPR Article 3(2) if they sell to or track people in the EU.
  • IP addresses, cookie IDs and device identifiers are personal data under Article 4(1).
  • Cookieless counting removes the consent step. Read the spec sheet before trusting that for replays.
REPLASTATS

Is your analytics GDPR compliant?

Check how Replastats counts visitors without cookies and keeps data on a separate server.

Visit →

Table of Contents

What "GDPR Compliant Analytics" Actually Requires

Two rule sets apply to web analytics in the European Union, and regulators check them separately. The GDPR governs processing of personal data. The ePrivacy Directive governs access to the visitor's device. A setup can satisfy one and fail the other.

The text of the GDPR applies when personal data is processed. Recital 26 says data protection principles do not apply to anonymous information, defined as information that does not relate to an identified or identifiable natural person, or to personal data rendered anonymous so the person is no longer identifiable. If your analytics cannot single anyone out, the GDPR does not reach it.

Pseudonymous data stays in scope. Hashing an IP address makes it harder to link a record to a person, and Recital 26 still counts that data as personal data when it can be attributed to someone by combining it with other information you hold.

ePrivacy Article 5(3) is the rule most site owners miss. It requires consent before storing information on, or gaining access to information already stored in, a visitor's terminal equipment. Cookies, localStorage and most device fingerprinting fall under it, and the contents of the cookie do not change the analysis.

A cookie set before the visitor consents breaches ePrivacy Article 5(3) even if it stores nothing but the word "pageview." The rule covers access to the device, not the data inside.

The UK's Information Commissioner's Office takes the same position on analytics cookies: they are not strictly necessary to deliver the page someone asked for, so consent is required in the UK too.

A working definition: GDPR compliant analytics is measurement that clears both tests, keeps a documented record of what it processes and where, and does not depend on a banner the visitor can refuse.

Do US Websites Need to Be GDPR Compliant? Yes, If You Have EU Visitors

Article 3(2) brings an organisation with no EU establishment into scope in two situations. You offer goods or services to people in the Union, or you monitor their behavior there. Recital 23 adds the qualification that mere accessibility of a website from the EU is not enough on its own; something has to show you envisage serving EU customers.

In practice a US retailer shipping to Germany, pricing in euros, or running German-language pages is in scope. A US blog with no EU targeting and a handful of EU readers sits in a gray area where the legal exposure is arguable and the practical risk is low.

Monitoring is the trigger that catches analytics directly. Recital 24 says tracking a person on the internet, including later profiling of their preferences and behavior, counts as monitoring their behavior in the Union.

Enforcement reach is worth knowing before you decide the risk is theoretical. Article 83(5) sets the upper tier of fines at 20 million euros or 4 percent of total worldwide annual turnover from the preceding financial year, whichever is higher.

If you have real EU traffic, the cheapest fix is the same for a Texas agency and a Berlin one: stop setting cookies for counting.

Two people stand at an office kitchen counter, one holding a mug and speaking while the other listens with arms folded.

In the EU, EEA and UK, yes in almost every case. The standard Google Analytics 4 tag writes first-party cookies on your domain and reads them back, and localStorage identifiers get involved as well. That is an ePrivacy Article 5(3) trigger, so consent has to come first.

Google's Consent Mode reduces what is collected when a visitor declines, and it is worth implementing if you keep the tool. It does not remove the banner requirement, because the tag still touches the device.

The transfer question has moved and the consent question has not. In 2022 the French authority CNIL concluded that a French website's use of Google Analytics could not rely on adequate safeguards for transfers to the United States as things stood then. The European Commission adopted the EU-US Data Privacy Framework adequacy decision in July 2023, which restored a transfer route for certified US companies.

Consent banners have their own rules, and regulators enforce them. On 6 January 2022 the CNIL fined Google 150 million euros and Facebook 60 million euros, in part because the button to refuse cookies was harder to reach than the button to accept them.

What Data Is Covered by the GDPR

Article 4(1) defines personal data as any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

For analytics, that list covers more than most people expect:

  • Direct identifiers. Names, email addresses, account IDs and anything typed into a form that lands in an event parameter.
  • Online identifiers. Cookie values, device IDs, mobile advertising IDs and browser fingerprints.
  • IP addresses. The Court of Justice of the European Union held in Case C-582/14 (Breyer, 2016) that a dynamic IP address is personal data for a website operator that has the legal means to identify the visitor by combining it with other information.
  • Hashed versions of any of the above. Hashing is a security measure, not a de-identification one, when you still hold the key or the input space is small enough to guess.

Article 9 is the trap that catches people who think traffic data is boring. It covers health, genetic and biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership and sexual orientation. Analytics collects none of that on purpose. It collects it through URLs.

A page path like /support/fertility-clinic or a search term like "biopsy results" is special category data the moment it reaches your reports.

Genuinely aggregated counts are out of scope. "1,240 visitors from Germany last month" with no route back to an individual is not personal data, which is why aggregated, cookieless counting is the simplest way out of most of this.

Cookieless is not the same as consent-free. The tag decides whether ePrivacy applies to your analytics. The rest of your page decides whether you need a banner at all.

Approach Device storage or cookies Banner needed in the EU/EEA What you give up
Cookie-based analytics behind a consent banner Yes Yes Everyone who declines is invisible, so your totals undercount
Cookieless counting, IP discarded or truncated No Usually no for the analytics tag itself Cross-session journeys and user-level funnels
Server-log counting kept in-house No No, unless retention makes people re-identifiable Setup time and no ready-made reports
Aggregated, non-identifying measurement only No No Audience exports, remarketing and ad platform matching

The honest trade-off is the third column. Cookie-based tools let you follow one person across visits and stitch sessions together. Cookieless counting gives that up and gives you a number you can trust without a legal review every quarter.

Session replay needs its own check. A recording of a single visit is a record of one person's behavior, so ask any vendor how they handle replay data, whether it is stored on their own infrastructure, and whether the recording captures form input. Some tools strip it; some do not. Get the answer in writing.

What Is a Better Alternative to Google Analytics? How to Choose One

For most site owners, freelancers and small agencies, a cookieless tool is the better pick. It removes a compliance step from every site you launch, and the reports fit on one screen instead of five. If you run paid acquisition and need conversions pushed into ad platforms, or you need funnel and cohort analysis, GA4 with Consent Mode and a properly built banner is still the stronger instrument. Choose on the analysis you actually do.

Some groundwork on the categories is worth reading first: why GA4 is so hard to use explains where the learning curve comes from, and cookieless web analytics covers exactly what you lose when the cookie goes away. If you are comparing vendors, picking a tool without a consent banner walks through the same criteria below.

Five things to check before you sign up

  • The data path. Ask where the servers are and whether the vendor acts as a processor or a controller. A vendor that acts as a controller can use your traffic for its own product decisions, and you cannot stop it with a setting.
  • The identifier. Does it store the full IP, truncate it, hash it, or never see it? "We anonymize IPs" without detail is not an answer.
  • Retention defaults. Find out how long raw data lives and whether you can shorten it. Long retention on identifiable data is the most common accidental problem.
  • What happens on decline. A tool that keeps counting after a refusal is either cookieless or non-compliant.
  • The exit. Can you export and delete everything, and does the contract say so?

Pro Tip: Run your own site with third-party scripts blocked and see whether the consent banner is still needed. On most sites the analytics tag is not the thing forcing the banner. Chat widgets, embedded video, externally hosted fonts and ad pixels usually are.

The 20-Minute GDPR Audit You Can Run on Your Own Site

You can test most of this yourself without a lawyer or a paid scan.

Step 1: Look at what is written before anyone consents

Open a private browsing window, load your site, and open developer tools. Go to Application, then Cookies. Anything listed before you click Accept is a problem under ePrivacy Article 5(3). Check Local Storage and Session Storage in the same panel.

Step 2: Read the request your analytics tag sends

Switch to the Network tab, filter for your analytics domain, and open the request payload. Look for a full IP address, a persistent user ID, or the complete page URL including query string. Any of those three turns an innocent counting script into personal data processing.

Step 3: Read the data processing agreement

Find your vendor's DPA. If it takes more than two clicks to locate, treat that as an answer about how the rest of the relationship will go. Check the sub-processor list and the server locations.

Step 4: Check what your URLs are leaking

Search your top pages report for paths that touch health, religion, politics or finances. Support forums, search parameters and logged-in URLs are the usual offenders, and they are the fastest way to end up holding Article 9 data you never intended to collect.

Then repeat the cookie check on a second site if you run several, and compare the results. Freelancers and agencies usually find the same four or five plugins causing the same problems on every build, which is why a templated setup beats an audit every time.

Get a Cookieless Analytics Setup You Never Have to Explain to a Regulator

Replastats is built for the situation described above. It installs with a single 4.7 KB deferred script tag, or a WordPress plugin that puts the reports inside wp-admin, and it counts visitors, sources, top pages and live traffic without cookies. Your data sits on a separate server instead of inside your site's database, and the tracking needs no consent banner. If you run several sites across WordPress, Shopify, Squarespace, Wix, Webflow or plain HTML, the Pro and Agency tiers put every site on one board, and Starter adds session replays and heatmaps. There is a free single-site tier if you want to run it against your current tool for a month first.

One limit worth stating plainly: cookieless measurement cannot follow a visitor across sessions or devices, so you will not get user-level funnels or audiences you can push into an ad platform. Replays and heatmaps also change what a single tool holds about one visit, so read the spec sheet, ours or anyone else's, before assuming a feature is consent-free.

Frequently Asked Questions

What is a better alternative to Google Analytics?

For most small sites, a cookieless analytics service that reports visitors, referrers and top pages without cookies is a better fit, because it removes the consent step and the reports are readable in under a minute. If you run paid campaigns and need conversions pushed into ad platforms, Google Analytics 4 with Consent Mode and a properly built banner is still the stronger tool. Decide based on whether you do user-level attribution work, not on which tool sounds more private.

Do US websites need to be GDPR compliant?

Only if you fall inside Article 3(2): you offer goods or services to people in the EU, or you monitor their behavior there. A US store that ships to Germany, prices in euros or runs German-language pages is in scope even with no EU office. A US site with no EU targeting and a handful of EU readers is a gray area with low practical risk, and switching to cookieless counting reduces the exposure either way.

In the EU, EEA and UK, yes in almost every case, because the tag writes cookies and reads them from the visitor's device, which triggers ePrivacy Article 5(3). Consent Mode cuts what is collected after a refusal but does not remove the banner requirement. The 2023 EU-US adequacy decision settled the transfer question for certified US companies; it did not settle the consent question.

What data is covered by the GDPR?

Anything relating to an identified or identifiable person, which Article 4(1) defines to include names, identification numbers, location data, online identifiers and factors specific to a person's identity. In analytics that means IP addresses, cookie IDs, device identifiers and hashed emails. Article 9 adds stricter rules for health, religion, political views, sexual orientation, trade union membership and genetic or biometric data, which can leak into reports through page URLs and search terms.

A cookieless analytics tag usually does not trigger ePrivacy consent on its own. Your site may still need a banner for other things: chat widgets, embedded video, externally hosted fonts, ad pixels, or a CMS plugin that sets its own cookies. Test with third-party scripts blocked and see what remains written to the device.

How long does a GDPR analytics fix take?

The technical switch takes about ten minutes per site if you are replacing a tracking tag with a script snippet. The slower part is finding every other script on the page that sets a cookie, which is why an agency running twenty sites should template the setup once instead of auditing each build from scratch.

Sources