Analytics and the GDPR: what applies and what you decide

Published 27 October 2026 · 10 min read

If people in the European Union use your website, two sets of rules can apply to your analytics. The General Data Protection Regulation (GDPR) applies to what you collect when it is personal data. The ePrivacy Directive's rule on device storage applies whenever the tool stores or reads something on the visitor's device, whether or not that is personal data. In short:

• Analytics tied to an identifier is usually personal data, even when it is pseudonymous.
• You need a lawful basis for it, usually consent or legitimate interests, and you must tell people about it.
• The company that runs the tool is usually your processor, which takes a written contract.
• If the data leaves the EU, the transfer needs a basis, such as an adequacy decision.
• Storing an identifier on the device needs consent unless an exemption applies, and national regulators read the exemptions differently.

This is not legal advice. The rules are applied by national regulators who do not all read them the same way; for a decision about your product, ask someone qualified where you and your users are.

Two rules, two questions

The GDPR asks whether you may process personal data, and on what terms. Article 5(3) of the ePrivacy Directive asks a different question: whether you may store or read anything on the person's device at all. One analytics script can raise both, and answering one does not answer the other.

Answering one question does not answer the other, so an analytics setup has to be checked against both.

Is analytics data personal data?

The GDPR defines personal data as "any information relating to an identified or identifiable natural person", and names "an online identifier" among the ways a person can be identified (GDPR, Article 4(1)). Recital 30 adds that people "may be associated with online identifiers provided by their devices", "such as internet protocol addresses, cookie identifiers or other identifiers".

A random identifier that says nothing about who someone is makes data pseudonymous, not anonymous. Recital 26 says pseudonymised data "should be considered to be information on an identifiable natural person", while truly anonymous information falls outside the Regulation. Whether someone is identifiable is judged by "all the means reasonably likely to be used".

The Court of Justice added a nuance in September 2025: pseudonymised data are not personal data "in all cases and for every person", since a recipient who cannot re-identify anyone may hold data that, for them, is not personal. But it also held that identifiability is assessed "at the time of collection of the data and from the point of view of the controller" (Court of Justice, press release 107/25, EDPS v SRB). The case was decided under the parallel rules for EU institutions, and the European Data Protection Board (EDPB) put its own guidelines on pseudonymisation out for consultation before the ruling (EDPB: Guidelines 01/2025), so how far the ruling reaches is still being worked out. For the site that collects the data, the safe reading is to treat analytics tied to an identifier as personal data.

The IP address counts too: every request carries one, so a tool receives it even if it discards it at once.

Which lawful basis

Article 6(1) lists the lawful bases. For analytics, two are usually discussed: the person "has given consent" for specific purposes, or the processing is necessary for "the legitimate interests pursued by the controller", "except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject" (GDPR, Article 6). The EDPB explains how to weigh that balance in its Guidelines 1/2024, published for consultation in October 2024.

Either way, Article 13 says what your privacy notice tells people: the purposes and legal basis, any legitimate interests relied on, the recipients, any transfer outside the EU and "the existence or absence of an adequacy decision", and how long data is kept.

You, the tool and the contract

The controller "determines the purposes and means of the processing"; the processor "processes personal data on behalf of the controller" (GDPR, Article 4(7) and (8)). For your analytics, that is normally you and the company running the tool.

Article 28 requires a contract, a data processing agreement, under which the processor acts "only on documented instructions from the controller", keeps the data confidential and secure, helps you answer people's requests, and deletes or returns the data at the end. A processor that starts deciding its own purposes "shall be considered to be a controller in respect of that processing". Ireland's regulator puts it in analytics terms: a party running analytics for a site is a joint controller or a processor "depending on whether it uses the data for its own purposes" (Data Protection Commission: guidance note on cookies; see also the EDPB's Guidelines 07/2020). So ask any tool whether it uses your visitors' data for anything of its own.

Where the data goes: transfers and adequacy

Personal data may leave the EU freely to a country the European Commission has found to give adequate protection: "Such a transfer shall not require any specific authorisation" (GDPR, Article 45). The Commission's list includes the United Kingdom, Switzerland, Japan, Canada for commercial organisations, and the United States for organisations in the EU-US Data Privacy Framework; for those, data can flow "without any further safeguard being necessary" (European Commission: adequacy decisions). Canada's decision rests on its federal private-sector law, PIPEDA (Commission Decision 2002/2/EC).

Anywhere else, a transfer needs "appropriate safeguards" under Article 46, most often the Commission's standard data protection clauses.

Who decides what the data is for shapes the contract, and where it is stored shapes the transfer.

The device-storage rule

Article 5(3) of the ePrivacy Directive allows storing information on a device, or reading it, only with consent given with "clear and comprehensive information", unless it is needed to carry out a communication or is "strictly necessary in order for the provider of an information society service explicitly requested" by the person to provide it (EUR-Lex: Directive 2002/58/EC). It is not limited to cookies: the EDPB's Guidelines 2/2023 explain how it reaches other storage, localStorage included. Nor does it depend on personal data: "It does not matter whether cookies contain personal data," says Ireland's regulator. More in Analytics without cookies.

Audience-measurement exemptions differ by country

The directive is applied through national law, and regulators read it differently for analytics:

• France. The CNIL exempts audience-measurement trackers from consent when, among other conditions, users are informed and can object, the purpose is limited to audience measurement and A/B testing, the data is not cross-checked with other processing, the tracker is limited to a single site or application, and its lifetime is capped at 13 months. It warns that "most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration" (CNIL: use analytics on your websites and applications).
• Ireland. The Data Protection Commission answers "Do analytics cookies require consent?" with "Yes." It adds, citing the EU's former Article 29 Working Party, that first-party analytics limited to aggregated statistics, with clear information and an easy opt-out, is not likely to create a privacy risk, and that it is unlikely to be "a priority for enforcement action" (guidance note, April 2020).

Other countries have their own guidance; check the regulator where your users are.

In the works. The Commission's Digital Omnibus proposal would add an exemption for aggregated audience measurement that a service carries out "solely for its own use". It is before the European Parliament and is not law (Legislative Observatory: 2025/0360(COD)).

Extensions and apps

Article 5(3) speaks of the user's terminal equipment, not of websites, so an identifier that an extension or an app keeps on the device is stored there too, and the GDPR applies the same way. What differs is the setting: an extension or app has its own settings, where an opt-in switch can live, and the stores ask you to declare what you collect; see the Chrome Web Store privacy practices tab and passing Firefox add-on review.

What to check

1. Is any of it personal data? An identifier, an IP address, event properties.
2. What is your lawful basis, and does your privacy notice say it?
3. Is the tool your processor, with a data processing agreement?
4. Where is the data stored, and is there an adequacy decision or safeguards for it?
5. What does the tool store on the device, and what does your users' regulator say about audience measurement?

Common questions

Does the GDPR apply if my business is outside the EU?

It can. Article 3(2) covers controllers outside the EU that offer goods or services to people in the EU, or that monitor "their behaviour as far as their behaviour takes place within the Union" (GDPR, Article 3). To decide whether processing monitors behaviour, Recital 24 says "it should be ascertained whether natural persons are tracked on the internet". Whether your analytics does is a question for advice.

Can I drop the consent banner?

Only where your users' regulator allows audience measurement without consent and your tool meets its conditions. That differs by country; decide with advice.

How AnalyticsTrend does it

AnalyticsTrend sets no cookies on the people it measures, and does not fingerprint. Its SDK keeps a random identifier in the site's or extension's own storage, scoped to that project alone; data tied to it is pseudonymous, not anonymous. The IP address is turned into a country, and in some countries a region, then discarded. Raw events are deleted after 90 days. On websites, a browser that sends Global Privacy Control is not counted at all, unless you turn that off. In an extension, the SDK honours Firefox's data-collection consent and your own consent switch, and Global Privacy Control where the browser lets an extension see it. The full list is in What it collects.

For customers subject to the GDPR, the data processing agreement is part of the Terms: it names you as the controller and Deasil as the processor, and lists the sub-processors. The data is stored in Canada, which, as above, has an adequacy decision for commercial organisations.

What stays with you: your lawful basis, your privacy notice, and whether the identifier kept on the device needs consent where your visitors are. AnalyticsTrend is designed to collect little, but you remain responsible for that decision. The website setup is in Install on a website; for extensions, see Store policy. For users elsewhere, see Analytics and Canadian privacy law and Analytics and US privacy laws.

---

Checked against the sources linked above on 27 October 2026. The quotations from the GDPR and the ePrivacy Directive were checked against the text of the Official Journal as reproduced on legislation.gov.uk.