GDPR and analytics: what a website owner needs to understand

This is general information to help you ask the right questions. It is not legal advice, and the rules differ in detail between countries. For decisions with real consequences, talk to a qualified adviser or your data protection authority.

Web analytics exists to learn about people's behaviour, and the General Data Protection Regulation (GDPR) governs how information about people may be handled. Most of what it asks of an analytics setup comes down to being clear about what you collect, why, and what people are told and can choose.

What counts as personal data

Personal data is any information that relates to an identified or identifiable person. The regulation names online identifiers among its examples. In practice that means a cookie id, a device or advertising id, a user id and, in many circumstances, an IP address can all be personal data, even if you do not know the person's name.

So "anonymous" analytics is often not anonymous in the legal sense. If a record can be linked to a person, directly or by combining it with other data you or a vendor hold, treat it as personal data.

Two sets of rules apply

1. GDPR covers processing personal data: why you do it, on what basis, how long you keep it, who sees it, and people's rights.
2. The ePrivacy rules (national laws based on the ePrivacy Directive) cover storing or reading information on a person's device, which is what cookies, local storage and similar tracking technologies do. They require consent unless the storage or access is strictly necessary to provide a service the user asked for.

The consequence: for most analytics and advertising cookies, you need the visitor's consent before the cookie is set, regardless of which GDPR lawful basis you would otherwise rely on for the later processing.

Consent that counts

When consent is needed it has to meet the GDPR standard: freely given, specific, informed and unambiguous, given by a clear affirmative action. In practice:

• No pre-ticked boxes. Silence, scrolling or continuing to browse is not consent.
• Nothing before the choice. Non-essential tags must not fire until consent is given.
• Real choice. Rejecting should be as easy as accepting, and a visitor should be able to withdraw consent as easily as they gave it.
• Specific purposes. Explain what each category (analytics, advertising) is for, in plain words, and let people choose by category.
• Records. Keep evidence of what a person agreed to, and when.

The six lawful bases

Every processing activity needs one of the grounds in Article 6:

Legitimate interests can sometimes cover back-end processing, but it does not replace the consent that the ePrivacy rules require for cookies.

Practical tasks

Know what you collect. List every tag, pixel and script, what it sends and to whom. Marketing tags added over the years are a common surprise.

Tell people. A privacy notice that states what you collect, why, the lawful basis, how long you keep it, who receives it and how to exercise their rights. Keep a cookie list that is accurate.

Limit retention. Keep data only as long as it is needed for the stated purpose, and set the retention period in the tool (Google Analytics 4, for example, lets you choose how long event-level data is kept).

Check your vendors. A vendor that processes personal data for you is a processor. You need a data processing agreement with them (Article 28), and you must know where the data goes. Transfers outside the European Economic Area need a legal mechanism, such as an adequacy decision or standard contractual clauses.

Collect less. Do not send e-mail addresses, names or free-text form content to analytics. Strip personal data from page addresses and parameters. Less data is less risk.

Honour rights. People can ask what you hold about them, ask for it to be corrected or deleted, object, and in some cases take it with them. Decide in advance how you would find and delete one person's analytics data.

Record your reasoning. For significant processing, write down what you do and why. It helps you spot problems, and it is the first thing a regulator will ask to see.

Consent mode and tag settings

Many tools offer a way to adjust tags according to the visitor's choice, for example by sending limited, non-identifying signals when consent is denied. Such features help you respect a choice technically. They do not decide whether your setup is lawful. That depends on what is actually sent and stored and on the vendor's terms, so read what each setting does.

A starting checklist

1. Inventory every tracking technology on the site.
2. Make non-essential tags wait for consent, and test that they really do.
3. Write a privacy notice that matches reality.
4. Sign processing agreements with vendors and check where data goes.
5. Set retention periods and minimise what you send.
6. Prepare a way to answer a rights request.
7. Review all of it whenever you add a tool.