GDPR and website analytics: a practical guide for small sites

October 27, 2026 · 6 min read

Entrepreneur at a desk using a laptop for business planning. Ideal for tech and startup themes. — Photo by RDNE Stock project on Pexels

What the GDPR actually covers in analytics

The GDPR applies when you process personal data. In analytics, personal data is not just names and email addresses. It can include IP addresses, cookie identifiers, device fingerprints, user IDs, and combinations of pages visited, timestamps, and technical details that make someone identifiable.

Many website analytics tools collect more than you think. A typical setup may record the visitor’s IP address, browser version, operating system, screen size, referrer URL, page path, and a unique client ID stored in a cookie. If any of that data can be linked to a person, directly or indirectly, you need a legal basis for processing it.

Small sites sometimes assume GDPR does not apply to them because they are too small or do not sell anything. The GDPR does not have a minimum size exemption. If your site is available to people in the EU and your analytics processes their personal data, the rules can apply.

ePrivacy and the cookie rule

The GDPR is not the only law to consider. The ePrivacy Directive, often called the cookie law, requires consent before you store information on a user’s device or access information already stored there, unless that storage or access is strictly necessary.

Cookies used for analytics are often not considered strictly necessary, which is why many sites show a consent banner before loading analytics scripts. This is a separate question from whether the analytics data itself is personal data under GDPR.

In practice, you should treat these as two layers:

Do you need consent before setting or reading cookies or similar storage?
Do you have a GDPR lawful basis for processing any personal data your analytics collects?

Check your own legal position rather than relying on a competitor’s banner or a blog post. The exact requirements depend on how your tool works, what it collects, and how you use the data.

Start with a data inventory

Before changing your analytics setup, list every tracker, pixel, and script that touches visitor data. For each one, note:

What it collects, including IP address, user agent, referrer, page paths, and event data
Whether it sets cookies or uses local storage
How long the data is kept
Who receives the data, such as a hosted analytics provider
Whether data leaves the EU or EEA
Whether the identifier follows people across sessions or across sites
Whether the tool is used for advertising, personalisation, or plain site measurement

This inventory helps you see which tools create the most compliance work. A basic pageview counter with no cookies is different from an advertising pixel that builds audiences and follows people around the web.

Lawful basis: consent or legitimate interest

Under GDPR, you need a lawful basis for processing personal data. The two bases most often discussed for analytics are consent and legitimate interest.

Consent means the visitor agrees to specific processing after being clearly informed. It must be freely given, specific, informed, and unambiguous. You must also make it as easy to withdraw consent as it is to give it.

Legitimate interest means you have a genuine business reason for processing the data, and that reason is not overridden by the visitor’s rights and interests. Some organisations use legitimate interest for basic website measurement, but it requires a balancing test and is not automatic.

For small sites, consent is often the more straightforward route if your analytics uses cookies or tracks individuals. But consent only works if it is collected properly and if analytics does not load before consent is given.

Consent banners done properly

If you need consent for analytics, a banner that says “by using this site you agree” is usually not enough. A consent banner should:

Tell people what you collect and why
Let them accept or reject analytics separately from necessary functions
Avoid pre-ticked boxes
Make rejecting as easy as accepting
Not force consent through a cookie wall unless you are confident that is lawful
Load non-essential scripts only after the visitor chooses

The banner itself is not the whole job. You also need a privacy policy, a record of consent, and a way for people to change their choice later.

Data minimization and retention

GDPR requires you to limit data to what is necessary. For analytics, that often means:

Reducing the detail you collect, such as truncating IP addresses
Avoiding cross-site tracking or advertising identifiers
Not combining analytics data with other datasets unless you need to
Storing raw logs for the shortest period that still gives you useful reports
Deleting old visitor-level data on a schedule

A dashboard that shows countries, pages, and sources does not usually require you to keep full IP addresses forever. If you can get the same insight from aggregate data, that is less risky than retaining raw visitor records.

Privacy policy and transparency

Your privacy policy should explain analytics in plain language. It should tell visitors:

What data the analytics tool collects
Why you collect it
Which legal basis you rely on
How long you keep it
Who processes it on your behalf
Whether data is transferred outside the EU
How people can exercise their rights

Do not copy another site’s policy. A policy that describes cookies you do not use or omits data you do collect creates confusion and can be worse than a short, honest one.

Processor agreements and international transfers

If you use a hosted analytics provider, that provider is usually a data processor on your behalf. You typically need a data processing agreement, or DPA, that covers what the provider may do with the data.

If the provider stores or processes data outside the EU or EEA, you also need to check whether an appropriate transfer safeguard exists. This can include standard contractual clauses or an adequacy decision, depending on the country.

Ask your analytics provider for its DPA and privacy documentation. If the provider cannot give clear answers about data location, retention, and sub-processors, treat that as a warning sign.

User rights

GDPR gives people rights over their personal data, including access, deletion, rectification, and objection. For a small site, handling these requests can feel heavy, but the risk is lower if you collect less data.

If your analytics only stores aggregate counts and no raw identifiers, there may be little personal data to access or delete. If you keep raw logs with IP addresses or cookie IDs, you need a way to find and remove records when someone asks.

Cookieless analytics can reduce the work

Cookieless analytics is not a magic exemption from GDPR, but it can remove some of the work. If a tool sets no cookies and uses no local storage, the ePrivacy consent requirement for storing information on the device may not apply in the same way. You still need to assess whether the tool processes any personal data.

For example, a hosted cookieless tracker such as measuremy.site sets no cookies and uses an anonymous id that changes daily, which reduces the data you collect and the consent work around cookies. That does not replace your own legal review, but it can simplify your data inventory and privacy notice.

A practical checklist for small sites

Use this as a starting point, not as legal advice:

List every tracker, pixel, and analytics script on your site
Decide your lawful basis for each one
If you use cookies for non-essential analytics, collect consent first
Configure your analytics to minimise data, such as shorter retention or reduced identifiers
Write or update your privacy policy in plain language
Sign a data processing agreement with your analytics provider
Check where the data is stored and whether international transfer safeguards apply
Set a deletion schedule for raw visitor-level data
Keep a short record of your decisions and the reasons behind them

If you use a cookieless hosted tracker such as measuremy.site, you still need a privacy notice, but you may have fewer data points to describe and less consent machinery to manage.

GDPR compliance for a small site is mostly about knowing what you collect, collecting less where possible, and explaining it honestly. If you get the data inventory and legal basis right, the rest becomes much easier to maintain.

See it on your own site

measuremy.site is cookieless analytics your coding agent can read. 30-day free trial, no card. Plans from $9/month.

Start free trial See the live demo

Add measuremy.site analytics to this project: connect the measuremy.site MCP server at https://a.measuremy.site/mcp for all my projects (claude mcp add --scope user; it signs in with OAuth, no key, and one sign-in covers every site), then tell me how to sign in. Details: measuremy.site/llms.txt

Free tools

Analytics tag checker: Which analytics and pixels a site runs, plus duplicate and broken tags.
Free UTM link builder: Add utm_source, medium and campaign to any link.
Website traffic checker: A site's popularity rank and estimated monthly visits.

All free tools