GDPR-Compliant Analytics, Explained in Plain English

The two answers owners usually get on this contradict each other, and neither side explains why. Two laws are in play, asking different questions. Once you can see the join, this stops being frightening.

One thing first. I am not a lawyer. I implement this for a living and read the regulators' own documents rather than summaries, but where a question turns on legal judgement rather than on what your website loads, you need somebody qualified.

Two laws, asking different questions

The first is the ePrivacy Directive, Directive 2002/58/EC, amended in 2009 by Directive 2009/136/EC, which is where the opt-in rule comes from. Being a directive, it does not reach you directly. Each country wrote it into its own statute. Its intended replacement, the ePrivacy Regulation, was drafted in 2017 and abandoned by the European Commission in its 2025 work programme.

Article 5(3) of it covers one narrow thing: storing information on a visitor's device, or reading information already there. It does not care whether that information is personal, which the Court of Justice said directly in Planet49 (case C-673/17, 1 October 2019), the judgment that also killed the pre-ticked box. Nor is it a rule about cookies. In guidelines 2/2023, adopted in final form on 16 October 2024, the European Data Protection Board applies the same test to localStorage, tracking pixels, identifiers bolted onto links, fingerprinting, and any script on your page that instructs the browser to send information back.

The second law is the GDPR, Regulation (EU) 2016/679, and it asks something else: may you process this personal data at all, and on which of the six lawful bases in article 6? Consent is only one of them. Legitimate interests is another, and for plenty of ordinary processing it is the right one.

So a tool can clear one hurdle and trip over the other. A cookie free script hosted inside the EU that still tells the browser to send back a device fingerprint has a tidy GDPR story and an ePrivacy problem. A product you have flawless consent for still has to answer for where the data goes.

What you can measure with no banner at all

Rather more than most owners expect, and rather less than some vendors advertise. Worth settling before you buy a banner, because sometimes the answer is that you drop two scripts and need none.

Your web server writes a line every time it answers a request: the time, the page, the referring site, the browser string, the IP address. That log exists because the browser asked for a page. Nothing was written to the device and nothing already on it was read, so article 5(3) is not engaged.

The GDPR has not gone away. An IP address can be personal data in the hands of a website operator, which the Court of Justice held in Breyer (case C-582/14, 19 October 2016), so you need a lawful basis, and legitimate interests under article 6(1)(f) is the usual one. That means a real retention period, not logs kept for ever, and an honest paragraph in your privacy policy.

That buys you sessions, popular pages, referrers, search engine crawling, broken links and slow pages. It does not buy reliable unique visitor counts, scroll depth, funnels, or following one person across visits. For a firm working out which service pages produce enquiries, it is often enough.

Now the caveat, because this is where the “we set no cookies, so we need no banner” marketing has run ahead of the law. The EDPB's 2024 guidelines say that when an entity instructs the terminal equipment to send information back, that instruction is itself a gaining of access, and they name JavaScript doing exactly that. They also say tracking that relies only on the IP address can fall inside article 5(3). So the safe line is this: what escapes the consent rule is what your server sees because the browser had to ask for the page anyway. What a script you added tells the browser to collect sits on the other side.

What “strictly necessary” actually covers

Article 5(3) carries two exemptions and no others. One is storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network. The other is storage or access strictly necessary for the provider of an information society service explicitly requested by the user to provide that service.

Read the second one slowly. It does not say necessary for the business. It says strictly necessary to deliver the thing the visitor asked for: the page, the basket, the login, the form they are halfway through. Session identifiers, basket contents, load balancing, the flag recording that they already answered your banner, all comfortably inside. Knowing how many people read your pricing page is necessary for you. It is not necessary to serve them the page.

Regulators have been unusually consistent about this, whatever articles on the subject imply. The Article 29 Working Party, predecessor of today's European Data Protection Board, addressed it in opinion 04/2012 and concluded that first party analytics cookies are not exempt. It also said they carry limited privacy risk when properly safeguarded, and recommended amending the law to exempt anonymised aggregated statistics. Fourteen years on, that amendment has not arrived at EU level. The gap between “low risk” and “exempt” is where most of the confusion lives.

The answer changes at the border

Because ePrivacy is a directive, national parliaments and regulators filled in the same outline differently. Selling across Europe means meeting the strictest rules among the countries you trade into, not an average of them.

The Netherlands. Article 11.7a of the Telecommunicatiewet carries an exception for storage and access with no more than minor consequences for privacy, and analytics used purely to produce statistics, not to treat one visitor differently from another, has long been understood to sit inside it. That is narrower than it sounds: once the supplier may use the data for its own purposes, the consequences stop being minor. The regulator has moved from writing to acting: the Autoriteit Persoonsgegevens has been checking Dutch banners systematically since April 2025, and said in November 2025 that it had warned more than two hundred websites, roughly three quarters of which changed them.

Germany. Section 25 of the TDDDG, the law called the TTDSG until it was renamed in May 2024, has no analytics exception at all: consent before anything loads, at the full GDPR standard. Germany also requires specific provider details in a specific place, under section 5 of the DDG, which replaced the TMG in the same month.

France. The CNIL exempts audience measurement from consent only if every condition is met at once: users informed and able to object, purposes limited to audience measurement and A/B testing, no cross referencing with other processing, the tracker confined to one publisher's site, the last byte of the IP address truncated, and tracker lifetime capped at thirteen months.

The United Kingdom. The Data (Use and Access) Act 2025 inserted a new Schedule A1 into PECR, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and from 5 February 2026 there are new exceptions to the consent rule in regulation 6. One covers storage or access whose sole purpose is collecting statistical information about how your service or website is used, with a view to improving it. You must give clear and comprehensive information and a simple, free way to object. The ICO's position is that the focus must be how the site is used rather than who is using it, that the output must be aggregate information that cannot identify anybody, and that a third party analytics supplier fits only if it acts purely on your behalf. The same Act raised the maximum PECR penalty from £500,000 to £17.5 million or 4% of worldwide turnover.

You will hear that the EU is about to relax all this, meaning the Digital Omnibus proposed in November 2025. It is not law, the Council has already dropped the browser signal provision that would have replaced per site banners, and it should change nothing you do this year.

Where the data goes, and why that is still live

If your analytics supplier stores data in the United States, you are making an international transfer, governed by chapter V of the GDPR. Since 10 July 2023 that has been covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework, which lets you send data to a self-certified US company without extra paperwork.

This is the third such arrangement, and courts struck the first two down. Safe Harbour fell on 6 October 2015 in Schrems I (case C-362/14). Privacy Shield fell on 16 July 2020 in Schrems II (case C-311/18). Anybody telling you the question is settled is not describing the record.

What is settled today is that the framework stands: the General Court dismissed a challenge to it on 3 September 2025 in Latombe v Commission. What is not settled is what happens next. That judgment was appealed to the Court of Justice on 31 October 2025 and the appeal is pending. The American oversight board the Commission leaned on when it judged US protections adequate, the PCLOB, lost its quorum in January 2025 when three of its four sitting members were removed, leaving one against a quorum of three. Treat this as a live risk, and know which tools would need replacing if the decision fell.

What a banner has to do to count

If consent is your route, it has to be the real thing. Under article 4(11) of the GDPR it must be freely given, specific, informed and unambiguous, indicated by a clear affirmative action. In practice, five things, and the fifth gets skipped most.

• Nothing fires first. No script, no pixel, no third party font call before the visitor has chosen. Consent given after the request has gone does not retrieve it.
• Refusing is as easy as accepting. Same layer, same number of clicks, comparable prominence. A green Accept beside a grey link into a settings submenu is the pattern regulators keep naming.
• No pre-ticked boxes. Settled since Planet49.
• Separate purposes. Analytics and advertising are different things, and a visitor must be able to agree to one without the other.
• Withdrawable. Article 7(3) says withdrawing consent must be as easy as giving it, so there has to be a permanent route back to the choice, not an email address buried in a policy page.

Cookie walls, where the site is unusable unless you accept tracking, are treated by the EDPB as consent that was not freely given. Its opinion 08/2024 on the related “consent or pay” model concluded that as large online platforms typically implement it, valid consent will usually not be obtained. That was aimed at large platforms, so treat it as a strong signal rather than a settled rule for a small business.

The part nobody warns you about

A compliant banner costs you data. When refusing really is as easy as accepting, a large share of visitors refuse, and everything downstream becomes partial. Traffic appears to collapse the day you fix the banner, and it has not moved. You have stopped counting people who never agreed to be counted.

I am not going to quote you a percentage. Published consent rates vary enormously by country, industry and wording, and most figures come from companies that sell consent software. Assume the loss is material and build around it.

Some products fill the hole with statistical modelling, estimating what the people who refused probably did from the behaviour of those who agreed. Find out which of your numbers were observed and which were inferred. Consented analytics is a sample, not a census: fine for comparing this month with last, weak ground for a precise claim.

Which tools actually help

Three groups, and the honest summary of each is short.

The mainstream advertising ecosystem products are very good at what they do and in normal configurations place identifiers on the device and send data outside the EU. Across most of the EU they need prior consent, and in the UK they usually fall outside the new statistical exception, because the supplier may use the data for its own purposes. That is not a scandal, it is the deal, and the deal has a banner attached.

The privacy focused category is genuinely different: no advertising identity graph behind it, aggregate reporting by design, and in several cases no data leaving Europe. Well known examples include Matomo, self-hosted or hosted, and hosted products such as Plausible, Fathom and Simple Analytics. On the French criteria above, the CNIL's own formulation is that most large audience measurement offerings fall outside the exemption whatever their configuration, and it points you to open source software you configure yourself, or to your provider. It used to assess named solutions and publish the results; since July 2025 providers self-assess against its criteria instead, so ask your supplier for that assessment rather than reading its marketing. Either way, “sets no cookies” and “needs no consent” are not the same sentence.

Third is the server log route above, which asks nothing of the visitor and answers fewer questions. Where those fewer questions are the only ones you actually have, it is the right answer.

Common questions