A legal basis
For tools that process personal data, this is usually consent or a documented legitimate interest, depending on the tool and your country.
Guide
GDPR-compliant web analytics: a practical guide
Web analytics and data protection law are closely linked. This guide explains what the GDPR means for measuring website traffic, what to look for in a tool and how to set up analytics in a privacy-friendly way.
Why web analytics falls under the GDPR
Many analytics tools process data that can identify a person, such as IP addresses, cookie IDs and device identifiers. Under the GDPR this is personal data, so you need a legal basis, transparency and appropriate safeguards.
In addition, rules such as the ePrivacy Directive (and its national versions, for example in Germany) require consent before you store or read information on a visitor's device, which covers analytics cookies.
What GDPR-compliant analytics needs
Data minimisation
Collect only what you need. Anonymous, aggregated statistics are better than user-level profiles.
Transparency
Describe your analytics in your privacy policy so visitors understand what happens.
Safe data transfers
If data leaves the EU, you need a valid transfer mechanism. EU hosting avoids the question.
A processing agreement
If a provider processes personal data for you, you need a data processing agreement.
Retention limits
Do not keep personal data longer than necessary.
Consent and cookies
Cookie-based analytics generally needs visitor consent in the EU. The consequence is the familiar cookie banner, and a share of visitors who decline and vanish from your statistics.
Some regulators, for example the French CNIL, have published conditions under which strictly limited audience measurement can run without consent. In practice, the simplest route is to choose a tool that does not use cookies and does not build profiles at all.
Data transfers and hosting
Transferring analytics data to US providers has been controversial. Several European data protection authorities have taken positions against specific Google Analytics set-ups, and the EU-US Data Privacy Framework has changed the legal situation since 2023.
Many organisations still prefer to avoid the question completely by choosing an EU-hosted provider. Noralytic is hosted in the European Union and does not store personal data of your visitors.
A GDPR analytics checklist
- Choose a tool that does not use cookies or store IP addresses.
- Prefer a provider that hosts data in the EU.
- Check which other scripts on your website set cookies.
- Mention your analytics tool in your privacy policy.
- Sign a data processing agreement if the provider processes personal data.
- Review your setup whenever you add new tracking tools.
How Noralytic supports GDPR-friendly analytics
- No cookies, local storage or fingerprinting.
- No IP addresses stored and no user profiles.
- Aggregated, anonymous statistics only.
- EU hosting and data you can export at any time.
- Sample privacy-policy text in our Cookie Policy and Privacy Policy.
This page is general information, not legal advice. Every website and country is different, so check your own requirements or ask a data protection professional.
Frequently asked questions
Is Google Analytics GDPR compliant?
It depends on configuration and national interpretation. Google Analytics uses cookies and processes data on Google infrastructure, so many organisations need consent and careful transfer assessment, and some prefer a different tool.
What makes a web analytics tool GDPR-friendly?
No cookies, no stored IP addresses, no user profiles, aggregated data, EU hosting and a clear data processing agreement are the main signs.
Do I need a data processing agreement for Noralytic?
Noralytic does not process personal data of your visitors. Business customers can still request a data processing agreement for legal certainty.
Do I need to mention my analytics tool in my privacy policy?
Yes, it is good practice and often required. Our policy pages include sample text you can adapt.
Keep reading
Try privacy-friendly analytics for free
Create a free account in seconds, add one line of code and see your first visitors live. No cookies, no credit card.