Web analytics is a valuable way to measure the performance of your website and marketing activity. It also creates privacy responsibilities. This guide outlines the main points to consider when choosing and configuring analytics tools.
Why does privacy matter in web analytics?
Web analytics records information about how people use a website. Depending on the setup, that data may include personal data such as IP addresses or unique cookie identifiers..
Under the GDPR, information that identifies or can relate to an individual is subject to data-protection requirements.
Non-compliance can lead to regulatory consequences and undermine visitors’ trust.
What does web analytics measure?
Analytics can use a range of metrics to explain and improve website performance, including:
✅ Visitor and session data — Who visits, how often and for how long? Examples include sessions, unique visitors and bounce rate.
✅ Interactions & engagement — Which actions do visitors take? Examples include clicks, scroll depth and form interactions.
✅ Traffic sources — Which channels send visitors, such as search, social media or paid advertising?
✅ Technical data — Which devices and browsers are used, and how well does the site perform?
✅ Conversion tracking — How many visitors complete a meaningful action such as a purchase or registration?
Keep in mind:
The depth and quality of data depend on the technology and configuration used. Privacy-focused or cookieless measurement may provide less granular user-level detail while still delivering useful aggregate insight.
Legal considerations for web analytics
The GDPR provides the main framework for processing personal data in the EU. German law also governs access to and storage of information on users’ devices. Because rules and guidance evolve, assess the current legal position for your specific setup.
As a general rule, placing cookies on a user’s device requires informed consent unless they are strictly necessary to provide the requested service. Analytics cookies should therefore normally be covered by a valid consent mechanism.
Privacy-focused analytics: practical steps
- Establish the appropriate legal basis: Determine whether consent is required before activating an analytics tool. Where consent is used, the banner and choices should be clear, specific and easy to understand.
- Minimise and protect data: Collect only what is necessary, shorten retention periods and use privacy controls such as IP truncation where appropriate.
- Evaluate cookieless analytics: A cookieless setup may reduce reliance on consent banners, but it does not automatically remove every privacy obligation. Assess the full technical implementation and legal basis.
- Be transparent: Explain which analytics tools are used, what data they process, why it is needed and how long it is retained.
- Put processor agreements in place: When an external provider processes personal data on your behalf, establish the required agreement and responsibilities under Article 28 GDPR.
- Practise data minimisation: Collect only the data needed for defined analytics goals and do not retain it longer than necessary.
Choosing a privacy-focused analytics tool
Some platforms are designed to give organisations more control over analytics data. Matomo, for example, can be self-hosted and offers a range of privacy settings. The final compliance outcome still depends on how any tool is configured and used.
Trackboxx is another option for privacy-focused web analytics . With Trackboxx as an alternative to Google Analytics , a conventional analytics Consent banner may not be necessary in some configurations because the product is designed to work without analytics cookies and to minimise personal data. This can reduce gaps caused by rejected analytics consent, although the specific legal position should still be assessed.
Balancing useful analytics with privacy is achievable when goals, data flows and retention are clearly defined. Choose suitable tools, configure them carefully and review the setup regularly so that measurement supports the business without disregarding visitors’ rights.
Try Trackboxx free for 30 days now
No payment information required! No automatic renewal! Your Trackboxx ready to go in 1 minute.
Deutsch 
English (UK) 
Français 
Italiano 
Español 
Nederlands 
Polski 
Svenska 