GDPR Compliance Guide for Website Analytics
Everything you need to know about running GDPR-compliant analytics. Updated for 2025 with the latest regulatory guidance.
Disclaimer
What is GDPR?
The General Data Protection Regulation (GDPR) is a European Union regulation that governs how personal data of EU residents must be handled. It applies to any organization that processes data of EU residents, regardless of where the organization is based.
For website analytics, GDPR is particularly relevant because most traditional analytics tools collect personal data like IP addresses, device fingerprints, and behavioral data that can identify individual users.
Key GDPR Requirements for Analytics
You need a legal justification to collect data. For analytics, this is typically either consent or legitimate interest (though legitimate interest is increasingly challenged for tracking).
Only collect data that's necessary for your stated purpose. Don't collect personal data if aggregate statistics would suffice.
Data can only be used for the specific purpose it was collected for. You can't collect data for "analytics" then use it for advertising.
Users have rights to access, rectify, and delete their data. They can also object to processing and request data portability.
The Problem with Google Analytics
Several EU Data Protection Authorities have ruled that using Google Analytics violates GDPR. Key rulings include:
- Austria (2022): DSB ruled Google Analytics illegal due to US data transfers
- France (2022): CNIL ruled Google Analytics violates GDPR
- Italy (2022): Garante ruled Google Analytics unlawful
- Denmark (2022): Datatilsynet ruled against Google Analytics
The core issues are:
- Data transfers to the US without adequate protection
- Collection of personal data (IP addresses, device fingerprints)
- Use of cookies requiring consent
- Data being accessible to US intelligence agencies
How to Run GDPR-Compliant Analytics
Privacy-first analytics tools like Invoker are designed to be GDPR compliant by default:
- No cookies or persistent identifiers
- No personal data collection
- IP addresses are anonymized or not stored
- Data stays in the EU
- No third-party data sharing
With these tools, you typically don't need cookie consent banners for analytics because no personal data is being processed.
If you choose to use Google Analytics or similar tools:
- Implement a proper cookie consent banner
- Don't load analytics until consent is given
- Allow users to withdraw consent easily
- Enable IP anonymization
- Disable data sharing with Google
- Sign a Data Processing Agreement
- Accept that many users will opt out
Note: Even with these measures, some DPAs have ruled this approach insufficient due to US data transfers.
When Do You Need Consent?
Under GDPR, you need explicit consent when:
- Setting non-essential cookies (like Google Analytics cookies)
- Collecting personal data without another lawful basis
- Tracking users across websites
- Building user profiles
You typically DON'T need consent for analytics when:
- No cookies or similar technologies are used
- No personal data is collected
- Data is aggregated and anonymized
- The analytics is strictly necessary for the service
What Makes Analytics "Privacy-First"?
For analytics to be considered privacy-first and potentially exempt from consent requirements, it should:
- No cookies: Don't set any cookies or use localStorage
- No fingerprinting: Don't build unique device identifiers
- IP anonymization: Don't store full IP addresses
- No cross-site tracking: Don't track users across domains
- EU hosting: Keep data within the EU
- No data sharing: Don't share data with third parties
Invoker Analytics is designed from the ground up to be GDPR compliant:
- No cookies: We don't use cookies or localStorage
- No personal data: We don't collect names, emails, or identifiable information
- IP anonymization: IP addresses are never stored in full
- EU data residency: Your data stays in European data centers
- No tracking: We don't track users across sites or build profiles
- No third parties: We don't share data with advertisers or anyone else
This means you can use Invoker without cookie consent banners while remaining fully GDPR compliant.