Skip to content
Statlyzer
Menu

GDPR for Web Analytics and Marketing: A Compliance Guide

Analytics under the GDPR is a series of narrow decisions: what counts as personal data, which legal basis applies, what a banner must actually do, and how long you keep any of it.

By Ethan Lewis Updated August 27, 2026 6 min read
Stacks of printed data reports on a wooden desk

Most analytics setups are not illegal. They are undocumented, which is a different problem with the same consequences during an inquiry. The GDPR does not ban measurement; it asks you to be able to say what you collect, why you are allowed to, how long you keep it, and who else sees it.

This is the practical version of those questions for a site running ordinary web analytics and marketing tags.

What counts as personal data here

More than teams expect. An IP address is personal data when the holder has means reasonably likely to be used to identify the person behind it — the position the Court of Justice took in Breyer, and the position regulators have applied since. A cookie identifier or any random visitor ID is personal data for the same reason: it singles out a device consistently.

What falls outside: genuinely aggregated counts with no route back to an individual. A daily total of page views is not personal data. A row per visit with a persistent identifier is, no matter how anonymous the vendor’s marketing calls it.

The practical test is not “does it contain a name”. It is “can this record be tied to one person, by us or by anyone with reasonably available means”.

Two separate rules, often confused

Analytics compliance in the EU sits on top of two instruments, and they ask different questions.

The ePrivacy Directive governs storing or reading information on a user’s device. Any cookie, and any read of local storage, needs consent unless it is strictly necessary for a service the user explicitly requested. Analytics is not strictly necessary in the regulators’ reading, however useful it is to you.

The GDPR governs what you then do with the personal data. It requires a legal basis, a purpose, a retention limit, a record of processing, and a contract with anyone processing on your behalf.

Clearing the first does not clear the second. A properly consented cookie still needs a lawful basis, a retention period and a data processing agreement behind it.

The requirements are specific, and the Court has been unambiguous about several of them. Consent must be freely given, specific, informed and expressed by a clear affirmative act — a pre-ticked box is not consent, as the CJEU held in Planet49.

What that means for a banner:

  • Nothing non-essential fires before the choice. If tags load on page view and the banner only stops them afterwards, you have collected without consent.
  • Refusing is as easy as accepting. One click each, at the same visual level. “Accept all” in a coloured button next to “Manage preferences” in grey text is the pattern regulators have repeatedly criticised.
  • Categories are granular. Analytics and advertising are separate purposes; bundling them into one switch is not specific consent.
  • Withdrawal is possible and easy. A persistent link that reopens the settings satisfies this. Withdrawal must stop future processing.
  • The record is kept. Who consented, to what, when, and which banner version they saw. Without that log you cannot demonstrate compliance, and demonstrating it is your obligation.

Can analytics run on legitimate interest?

For the data processing, sometimes. For the storage on the device, no — that part is governed by ePrivacy and needs consent regardless of your GDPR basis.

This is why cookieless measurement gets attention: a tool that reads nothing from the device and stores nothing on it can, in some readings and some jurisdictions, avoid the consent requirement for that step. It is a narrower path than vendors suggest, it depends on the national implementation, and it does not remove the GDPR obligations that follow. Take local advice before relying on it.

International transfers

In 2022 several supervisory authorities — Austria, France and Italy among them — found that the then-standard Google Analytics configuration sent personal data to the United States without adequate protection. The legal position changed in July 2023, when the European Commission adopted an adequacy decision for the EU–US Data Privacy Framework, allowing transfers to certified US organisations without additional safeguards.

Two things follow. Check that your vendor is certified under the framework if data leaves the EEA. And note that adequacy decisions have been annulled before; a setup that depends entirely on one is a setup with a single point of legal failure. EU-hosted or self-hosted analytics removes the question rather than answering it.

Settings that do measurable work

Four configuration items, each of which reduces exposure without costing you insight.

Setting Why it matters
Retention period Storage limitation is a principle, not a preference. GA4 offers two or fourteen months for user-level data; the shorter option is the defensible default unless you can justify longer.
IP handling Confirm what the tool does before storage. Truncation or discarding at collection is the difference between holding an identifier and holding a country.
Data sharing toggles Vendor “product improvement” and benchmarking options are separate purposes and need their own basis. Off by default is the safer position.
Personal data in URLs and events Emails in query strings, order numbers, form values captured by a generic listener. This is the most common real breach in analytics, and it is entirely self-inflicted.

The paperwork an inquiry asks for

Three documents, none long:

A record of processing activities. Purpose, categories of data, recipients, transfers, retention, security measures. One page per processing activity is plenty for a small site.

A data processing agreement with each vendor. Article 28 requires it with every processor. Most analytics providers publish one you accept in the interface; save a dated copy rather than trusting a link.

A privacy notice that matches reality. The failure mode is drift: the notice describes the tool you used two years ago. Review it when you add a tag, not annually.

A data protection impact assessment is required for large-scale or high-risk processing. Ordinary site analytics on a small site usually is not, but combining behavioural tracking with profiling for advertising can be.

Rights requests you will receive

The common ones are access and erasure. Answer two questions in advance and both become routine: can you find every record tied to one identifier, and can you delete them within a month?

If your analytics stores a visitor ID and you have no way to search by it, the answer to both is no — and that gap, not the presence of a tag, is what turns a complaint into a finding.

Where to start if none of this exists yet

Inventory every tag on the site, including the ones added by a plugin you forgot about. For each: what it stores on the device, where the data goes, and which purpose it serves. Delete the ones nobody reads — the fastest compliance win available is having fewer processors. Then fix the banner so nothing non-essential fires before a choice, set retention to the shortest period you can work with, and write the one-page record.

That sequence takes a day on most sites and closes the findings that inquiries begin with.

Ethan Lewis

Ethan Lewis has spent a decade wiring analytics into sites that were never built for it — e-commerce carts, membership portals, marketing sites with three tag managers. He writes Statlyzer to keep the answers in one place.

Keep reading