GDPR Compliant Web Analytics: What to Check Before You Pick

No analytics tool is “GDPR compliant” on its own. Compliance describes how you use a tool: what data you collect, why, where it goes, how long you keep it and whether visitors are informed. A cookieless, EU-hosted, minimal-data tool makes compliance much easier, but the duty stays with you.

This article is general information, not legal advice. Rules and regulator positions change; check official sources and consult counsel for your situation.

The two laws people mix up

GDPR governs personal data. The ePrivacy rules, implemented as national law (in the UK, PECR), govern storing or reading information on a visitor’s device, which is what cookies do. Analytics can touch both. A cookieless script reduces ePrivacy exposure, but if the data it processes is personal data, GDPR duties still apply. The UK ICO’s guidance on cookies and similar technologies is a good starting point for the device-storage side, and gdpr.eu provides general GDPR resources.

Key takeaway: separate the questions. “Do I need consent to read or write on the device?” and “Am I handling personal data lawfully?” have different answers and different authorities.

Seven things to verify in any tool

Check	Why it matters	What to look for
Cookies or device storage	Triggers ePrivacy consent rules	Documented: none, or exactly what is stored
Personal data collected	Triggers GDPR duties	Short list; no cross-site profiling
Hosting location	Affects transfer analysis	Stated region and storage provider
Retention period	Storage limitation principle	A number, such as months, not “indefinite”
Sub-processors	You must know who touches data	A public register with change notice
Data processing agreement	Required where a processor acts for you	Available without a sales call
Data subject requests	You must respond to access and deletion	A documented process

BusinessMCP publishes details on several of these. Its web analytics page says the tracker sets no cookies and uses no fingerprinting, that event data is stored in London, that raw events are kept up to 13 months, and that a sub-processor register and a DPA with 30 days’ notice for new sub-processors are available. Treat those as vendor statements to confirm against the DPA itself, and do the same for any competitor.

Where analytics usually goes wrong

1. Assuming a vendor’s badge equals compliance. Badges and blog posts are not a legal analysis of your site.
2. Forgetting add-ons. The base script may be light-touch while a replay tool, ad pixel or identification feature needs consent. BusinessMCP’s own page notes that other tools such as ad pixels, replays and identification may still need consent, and its script supports gate-all or split consent modes.
3. Skipping documentation. Your privacy notice should describe analytics in plain language.
4. Keeping data too long. Set a retention rule and stick to it.
5. Ignoring identifiers in URLs. Email addresses and tokens in query strings end up in page URLs and, therefore, in analytics. Strip or mask them.

A practical compliance routine

Work through this order, which most small teams can finish in an afternoon.

1. List every script on your site and what each does.
2. Classify each one: essential, analytics, advertising, other.
3. For analytics, pick a tool that minimises data, then read its DPA and sub-processor list.
4. Decide your lawful basis and record the reasoning.
5. Update the privacy notice and, if any tool needs consent, configure the banner to gate it.
6. Set retention and calendar a yearly review.

For the banner question in particular, read analytics without a cookie banner. For tool choices, see privacy-friendly analytics tools.

Country differences

European regulators do not all read the rules identically. Some treat strictly limited audience measurement more leniently than others, and the picture evolves with court decisions and guidance. BusinessMCP maintains an overview of website tracking laws by country; use it as a map, then confirm against your national regulator’s page, which is the authority for your market.

When to involve a lawyer

Call counsel if you process sensitive categories (health, children, finance), operate in regulated industries, transfer data outside the EU or UK, or are responding to a regulator or complaint. For a typical marketing site using a minimal, cookieless tool, the routine above plus a clear privacy notice covers the common ground, but only counsel can confirm that for your facts.

The related pre-launch checklist turns this into a printable list.

Documenting your decision

Regulators tend to care less about which tool you chose than whether you can show you thought it through. Keep a one-page record covering the purpose of analytics (improving content and measuring campaigns, for example), the data collected, the lawful basis you rely on, the vendor’s DPA, the hosting region, the retention rule and the review date. If the setup changes, update the record. A dated page of this kind answers most customer questionnaires and many audit questions in minutes.

How cookieless design helps, and where it stops

Design choices that reduce risk include rotating visitor identifiers, truncating or not storing IP addresses, avoiding cross-site tracking and collecting only the events you need. A cookieless, first-party setup such as the one BusinessMCP describes on its web analytics page, which says identification is company-level unless a visitor identifies themselves, fits that pattern. Design stops short of your own responsibilities, though. If you add custom events that capture form content, emails or account IDs, you create personal data yourself, and the tool’s privacy-friendly defaults no longer describe what you do.

Questions for a vendor review

• What exactly is stored in the browser, and for how long?
• Where do events live, and who hosts them?
• Can I set or shorten retention?
• How do I delete a specific person’s data if asked?
• How will you tell me about new sub-processors?
• What happens to my data when I leave?

Vendors that answer in writing and point to a public register are easier to work with than those who send a generic compliance PDF. If you are choosing between several, the comparison in Plausible vs Fathom vs Matomo includes hosting and licence differences that touch these questions.