Personal Data in Analytics

Why this question decides everything else

GDPR has a material scope. Article 2 limits it to the processing of personal data, and Article 4(1) defines that as information relating to an identified or identifiable natural person. If a dataset contains no personal data, GDPR does not apply to it — not in a reduced form, not with lighter obligations. It is out of scope.

That is why “can we do analytics without personal data?” is a more useful question than “what is our legal basis?” A lawful basis is something you need once you are inside the regulation. Staying outside it removes the consent question, the data subject rights machinery, and the transfer assessment in one move.

What counts as personal data in an analytics dataset

More than most teams expect. “Identifiable” does not require a name. Under Article 4(1) it covers anyone who can be identified “directly or indirectly, in particular by reference to an identifier.” In practice, standard analytics collects several:

— IP addresses. Settled as personal data in EU case law, including when only the site operator plus a third party could combine information to identify someone.
— Cookie and device identifiers. A random ID that persistently distinguishes one browser from another is an identifier, even though it carries no name.
— Fingerprints. Derived identifiers assembled from device and browser characteristics count too — the mechanism does not matter, the singling-out does.
— Combinations. Fields that are innocuous alone can identify someone together, which is why granular timestamps plus location plus device can be personal data even without an ID.

The bar for calling data anonymous

Recital 26 sets it, and it is higher than the word suggests in everyday use. Data is anonymous when the person is not identifiable by any means reasonably likely to be used — by you or by anyone else. That is an objective test about what is possible, not a statement of your intentions.

Two consequences that catch people out. First, pseudonymised data is not anonymous: if an identifier can be reversed or rejoined with a key, the data is still personal and still in scope. Hashing an email produces pseudonymous data, not anonymous data. Second, aggregation is only anonymous if it is irreversible — a report so sparse that a single row describes one person has not anonymised anything.

The practical test is whether a single individual can be singled out from the dataset. If a row can be traced to one person, it is personal data regardless of what the column is called.

The trap: ePrivacy does not care

This is the part most guidance on this topic omits, and it is where teams get caught.

Escaping GDPR does not escape the ePrivacy Directive. Article 5(3) governs the storage of, or access to, information on a user’s device, and it applies regardless of whether the stored value is personal data. A cookie holding a purely random number, containing nothing personal at all, still requires consent — because the act of writing it to the device is the regulated event.

So there are two separate tests, and analytics has to clear both to run without a banner:

— GDPR: is any personal data processed? If no, out of scope.
— ePrivacy: is anything stored on or read from the device? If no, Article 5(3) is not engaged.

A tool that collects no personal data but still sets a cookie passes the first and fails the second. Only a tool that does neither can lawfully measure without consent.

What this looks like in practice

It means giving things up, and it is worth being explicit about which. Analytics that processes no personal data cannot reconstruct an individual’s journey, cannot recognise a returning visitor as the same person, cannot build audience segments for activation, and cannot attribute across sessions. Those capabilities all depend on the identifiers that put you in scope.

What it keeps is the measurement most commercial decisions actually run on: how many people arrived, from which channel and campaign, what they did, and what revenue resulted — attributed last-click across the whole dataset rather than the consenting fraction of it.

This is the architecture behind consentless analytics: no identifiers, no device storage, aggregate event measurement only. Because neither test is engaged, the consent banner stops being a data-loss path — which matters when 40–60% of EU visitors decline it. The longer legal argument is in the two-part legal assessment, and the consent-specific case in analytics without consent banners.

This is an explanation of how the regulation applies to analytics technology, not legal advice. Your DPO or counsel owns the conclusion for your deployment.