GDPR Analytics Compliance

What does GDPR require from web analytics?

The General Data Protection Regulation (GDPR) applies to any processing of personal data of EU residents. For web analytics, the key requirements are:

• —Lawful basis — typically consent (Article 6(1)(a)) for cookie-based tracking, or legitimate interest for non-personal data collection
• —Data minimization — collect only what is necessary for the stated purpose
• —Purpose limitation — use the data only for the declared analytics purpose
• —Storage limitation — define and enforce data retention periods
• —Data subject rights — facilitate access, rectification, erasure requests

What does the ePrivacy Directive add?

Beyond GDPR, the ePrivacy Directive (Article 5(3)) requires consent before accessing or storing information on a user’s device — which includes setting cookies. This is why consent management platforms are required for cookie-based analytics.

How does cookieless analytics achieve compliance by architecture?

Cookieless analytics approaches compliance differently. By storing nothing on the visitor’s device, keeping no data that identifies anyone and reporting only in aggregate, it can rely on the audience-measurement exemption from ePrivacy consent, and GDPR obligations are minimal. This follows CNIL (France) and other EU authorities’ guidance on audience-measurement exemptions; in Germany the DSK does not extend the exemption to audience measurement.