GDPR and Web Analytics: A Practical Privacy-First Guide

The short answer

For every analytics field and identifier, be able to answer: Why do we need it? What is our legal basis? Where does it go? Who can access it? How long is it kept? How can a person exercise their rights? If one answer is missing, the setup is not ready for production.

• ✓Map the exact data flow—not just the vendor name
• ✓Separate device-storage rules from the GDPR legal basis for later processing
• ✓Collect only fields tied to a documented decision
• ✓Give visitors concise, specific information
• ✓Set and enforce deletion or review dates
• ✓Keep contracts, settings, tests, and decisions as accountability evidence

1. Decide whether analytics processes personal data

Online identifiers, cookie IDs, full IP addresses, user IDs, and combinations of device or behavioural data may relate to an identifiable person. Pseudonymised data remains personal data when it can be attributed using additional information. Truly anonymous aggregate data falls outside the GDPR, but anonymisation is a demanding standard—not a marketing synonym for hashing.

Review the complete path from browser to report. URLs can leak names, email addresses, order numbers, search terms, or reset tokens. Referrers, custom properties, support recordings, and data exports deserve the same review as the core event payload.

2. Apply the seven GDPR principles

The European Commission summarises seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Turn each one into a testable analytics control.

3. Treat cookies and consent as a separate decision layer

The ePrivacy rules govern storing information on, or accessing information from, a visitor’s device; the GDPR governs processing of personal data. The EDPB states that cookies used to process personal data engage GDPR and that storing or accessing cookies generally requires adequately informed consent, subject to applicable exceptions and national implementation.

Valid consent must be freely given, specific, informed, and unambiguous, and withdrawal must be as easy as giving consent. Do not use pre-ticked boxes, infer consent from scrolling, load non-essential tags before the choice, or make rejection materially harder than acceptance. A cookieless setup reduces one class of storage, but does not automatically settle whether other identifiers or processing require a legal basis or consent.

• ✓Block non-essential storage and tags until the relevant choice
• ✓Offer clear accept and reject controls
• ✓Describe purposes and vendors before consent
• ✓Record the choice without collecting more data than needed
• ✓Make withdrawal persistent, visible, and easy
• ✓Re-test after tag-manager, CMP, or tracker changes

4. Document purpose and legal basis before implementation

Do not choose a legal basis from a generic template. Describe the actual purpose first—for example, aggregate service reliability measurement versus cross-site advertising profiles—then assess the appropriate basis with qualified advice. If relying on legitimate interests for personal-data processing, document necessity, balancing, reasonable expectations, safeguards, and the right to object. It does not replace consent where device-access rules require consent.

Consent is not strengthened by vague language. Each purpose should be granular enough for a person to understand the consequence of agreeing or refusing.

5. Write an analytics privacy notice people can use

Articles 12–14 require information to be concise, transparent, intelligible, accessible, and in clear language. Place a short just-in-time explanation near the choice and link to a fuller notice. Keep the notice aligned with the actual network requests and product settings.

• ✓Controller identity and contact details
• ✓Specific purposes and legal basis
• ✓Categories of data and how identifiers work
• ✓Recipients, processors, and relevant international transfers
• ✓Retention period or the criteria used to set it
• ✓Rights, withdrawal, objection, and supervisory-authority complaint
• ✓Whether data is required and the consequence of not providing it
• ✓Relevant automated decision-making information

6. Govern analytics vendors and processors

When a vendor processes personal data on your behalf, assess its role and put Article 28 terms in place. Check instructions, confidentiality, security, subprocessor controls, assistance with rights and incidents, deletion or return, and audit information. If data leaves the EEA, document the transfer mechanism and supplementary measures where required.

• ✓Record hosting regions and every subprocessor
• ✓Restrict vendor use of customer data to documented instructions
• ✓Review admin access and export permissions
• ✓Test deletion at account, site, and event level
• ✓Create an incident contact and escalation path
• ✓Reassess material product or subprocessor changes

7. Set retention from the purpose—not a round number

The Commission explains that personal data should be kept for the shortest time possible, with time limits to erase or review it. Separate raw event retention from longer-lived anonymous aggregates. A useful schedule names the data class, purpose, duration, deletion method, owner, and exception.

8. GDPR analytics launch checklist

• ✓Inventory scripts, pixels, SDKs, cookies, local storage, and server events
• ✓Capture and inspect real payloads on every important journey
• ✓Strip query values and block sensitive routes by default
• ✓Create a field-level purpose and retention map
• ✓Complete the legal-basis and ePrivacy assessment
• ✓Sign processor terms and review transfers and subprocessors
• ✓Update the privacy notice and consent interface
• ✓Test accept, reject, ignore, withdraw, and expired-choice states
• ✓Restrict access and enable deletion procedures
• ✓Schedule quarterly and post-release reviews

Frequently asked questions

Does cookieless analytics guarantee GDPR compliance? No. Cookies are only one possible technology. Identifiers, IP handling, event content, purpose, legal basis, transparency, retention, security, and vendor relationships still matter.

Can analytics run without consent? The answer depends on device access, whether personal data is processed, the purpose, safeguards, national ePrivacy implementation, and available exemptions. Do not treat a vendor claim as a jurisdiction-specific legal conclusion.

Is hashing an email anonymous? Usually not by itself. If a value can still be singled out, matched, or attributed with other information, it is generally pseudonymised rather than anonymous.

Who is responsible: the site or the analytics vendor? Roles depend on the facts, but a site choosing purposes and means will commonly have controller responsibilities; a service provider may be a processor for some activities and have separate roles for others.