--- title: "Regulatory Gap Analysis for Web Analytics | GDPR" description: "A requirement-by-requirement gap analysis of web analytics under GDPR, ePrivacy, AEPD and UK PECR — where stacks fall out of compliance and how to fix it." canonical_url: "https://sealmetrics.com/reg-gap-analysis/" lang: "en" content_type: "product" owner: "web" llm_priority: "useful" last_verified: "2026-08-14" source: https://sealmetrics.com/reg-gap-analysis/ publisher: SealMetrics --- Regulatory gap analysis # Find where your analytics *falls out of compliance.* “GDPR-compliant” is a claim, not an audit. A gap analysis maps your analytics stack against every requirement it actually has to meet — ePrivacy, GDPR, the Spanish AEPD, UK PECR — and shows exactly where it falls short. Below is the framework, requirement by requirement, and how a cookieless architecture closes each gap. [Get a free measurement audit →](https://sealmetrics.com/audit/)[Book a Demo](https://sealmetrics.com/demo/) GDPR · ePrivacy · AEPD · UK PECR TL;DR A regulatory gap analysis maps analytics against **ePrivacy**, **GDPR**, **AEPD** and **UK PECR** to find where it falls short. Cookie-based tools open gaps on device storage, lawful basis, transfers and data-subject rights. A **cookieless, zero-PII, EU-hosted** architecture closes them by design. - The recurring gaps: cookies (ePrivacy), personal data (GDPR), US transfers (Schrems II), banner UX (AEPD). - Cookieless + zero personal data + EU hosting in Dublin clears most requirements structurally. - Read the legal reasoning in our [GDPR & ePrivacy legal assessment](https://sealmetrics.com/blog/gdpr-eprivacy-analytics-legal-assessment/). ## The *single source of truth* eCommerce signs against **Dreamplace Hotels** recovered **+30% more traffic** vs GA4 and closed a **15–20% gap** in sales attribution against their CRM. **Palladium Hotel Group** recovered **35% of unattributed bookings** and improved Display CPS by **+165%**. ![Palladium Hotel Group](https://sealmetrics.com/logos/clients/palladium-dark.svg) ![Dreamplace Hotels](https://sealmetrics.com/logos/clients/dreamplace.svg) ![Acciona](https://sealmetrics.com/logos/clients/acciona.svg) ![Crocs](https://sealmetrics.com/logos/clients/crocs.svg) ![Desigual](https://sealmetrics.com/logos/clients/desigual-dark.svg) ![UNICEF](https://sealmetrics.com/logos/clients/unicef.svg) ![Casa Batlló](https://sealmetrics.com/logos/clients/casabatllo.png) ![Juguettos](https://sealmetrics.com/logos/clients/juguettos.png) ![3Cat](https://sealmetrics.com/logos/clients/3cat.png) ![Fundación Bankinter](https://sealmetrics.com/logos/clients/fundacion-bankinter.png) ![Dormideo](https://sealmetrics.com/logos/clients/dormideo.png) ![Incapto](https://sealmetrics.com/logos/clients/incapto.svg) The framework ## Eight requirements, *one honest audit.* For each requirement: what the law demands, where a typical GA4 or Adobe stack opens a gap, and the architectural change that closes it. This is the compliance layer behind [GDPR-compliant analytics](https://sealmetrics.com/glossary/gdpr-analytics-compliance/). ePrivacy · Art 5(3) ### Consent for device storage Any non-essential cookie, localStorage entry or fingerprint needs prior consent before it is set. Gap GA4 and Adobe set cookies, so a consent banner is mandatory — and roughly a third of EU visitors decline it. Closed No cookies, no localStorage, no fingerprinting — nothing is stored on the device, so no consent is triggered. GDPR · Art 6 ### Lawful basis for personal data Processing an IP address or online identifier needs a valid lawful basis — consent or a defensible legitimate interest. Gap Cookie-based tools lean on consent that is often withheld, or a legitimate interest that regulators increasingly contest. Closed Measurement processes no personal data at all, so there is no basis to establish — GDPR does not apply to it. GDPR · Art 5(1)(c) ### Data minimisation Collect only the data necessary for the purpose — no more. Gap Client IDs, device graphs and behavioural profiles collect far more than measurement requires. Closed Aggregate, anonymous events only — the minimum needed to count what happened, nothing that identifies a person. GDPR · Chapter V ### International data transfers (Schrems II) Personal data may not be transferred to a third country without adequate protection. Gap GA4 and Adobe are US processors; specific deployments were ruled unlawful by EU regulators over US transfers. Closed Hosted end-to-end in Dublin, Ireland. No transfer to the US, no reliance on contested transfer mechanisms. GDPR · Art 15 & 17 ### Data subject rights (access, erasure) Individuals can request access to, and erasure of, their personal data. Gap Per-user analytics data creates a standing obligation to locate, disclose and delete it on request. Closed No personal data is stored, so there is nothing to disclose or erase — the obligation never arises for measurement. AEPD · cookie guidance ### Valid consent UX (Spain) Rejecting must be as easy as accepting, with no cookie walls and granular, unbundled choices. Gap Dark-pattern banners that nudge acceptance are a frequent source of AEPD complaints and fines. Closed With no cookies in scope for measurement, there is no banner to design, and no dark pattern to defend. GDPR · Art 28 ### Processor terms & DPA A data processing agreement must be in place with every processor handling personal data. Gap Analytics, tag managers and CMPs form a patchwork of processors, each needing its own signed DPA. Closed One EU processor, one DPA included as standard — a materially smaller processor surface to govern. UK · PECR / DUAA 2025 ### Analytics consent exemption Analytics can run without consent in the UK only if it meets the DUAA 2025 / PECR exemption criteria. Gap Cookie-based, cross-site or personal-data analytics does not qualify for the exemption. Closed Cookieless, first-party, no personal data — the profile the exemption was written for. See our PECR self-assessment. Score your stack ## A two-minute self-assessment. Answer these six questions about your current analytics. Every **“yes”** is an open gap against one of the requirements above. **0 gaps** — your measurement is compliant by architecture. **1–2 gaps** — configuration risk; worth a formal review. **3+ gaps** — you are relying on consent and losing EU data to it. A cookieless architecture closes the set at once. [Get a free measurement audit →](https://sealmetrics.com/audit/) 1. 01 Does your analytics set any cookie, or store anything on the visitor's device? 2. 02 Do you show a consent banner in order to measure traffic? 3. 03 Does your tool process IP addresses or persistent identifiers? 4. 04 Is your analytics data processed in the US, or by a US-headquartered company? 5. 05 Would fulfilling an erasure request for analytics data be difficult? 6. 06 Do you lose EU visitors from your reporting when they reject the banner? From analysis to evidence ## A gap analysis is only useful if you can prove the close. Closing a gap on paper is one thing; producing the documentation a DPO or regulator will accept is another. We publish the evidence: the [CNIL self-assessment](https://sealmetrics.com/blog/cnil-self-assessment-published/) showing how the architecture meets France's technical criteria, the [security & compliance](https://sealmetrics.com/security/) posture (EU hosting in Dublin, Schrems II, the TPSR package), the DPA included as standard, and the underlying [cookieless architecture](https://sealmetrics.com/cookieless-analytics/) that makes the gaps close by design rather than by configuration. FAQ ## The *questions* a compliance review raises. Honest answers about analytics gap analysis, which regulations to cover, and what it takes to measure lawfully without a consent banner. Still have questions? Our team — including the founder — is one message away. [Talk to us →](https://sealmetrics.com/demo/) ## Stop assuming compliance. *Analyse the gaps.* Run SealMetrics alongside your current analytics for 30 days. See the gaps close and the EU data you were losing come back. If the gap isn't real, you owe us nothing. [Get a free audit →](https://sealmetrics.com/demo/)[Start 14-day trial](https://my.sealmetrics.com/register) Built by a founder · supported by a founder · EU-hosted by design