Skip to main content

GDPR Compliant Analytics: Complete Framework 2026

· 35 min read
Rafael Jimenez
Rafael Jimenez
Founder & CEO at Sealmetrics

TL;DR — GDPR framework for web analytics: which legal basis you actually need, the technical requirements, and how to stop losing 15-60% of your data to consent.

The European Union issued over €20 million in fines for analytics violations in 2023, yet most companies still don't understand what makes their analytics GDPR compliant. Many businesses either accept massive data loss from cookie consent requirements or operate in a gray area of regulatory uncertainty.

This comprehensive framework explains exactly what GDPR compliance requires for web analytics, which legal bases work, and how to implement compliant tracking without losing visitor data.

Key Takeaways:

  • Consent-based analytics loses 15-60% of your data; the strongest position isn't a better Article 6 basis, it's not needing one
  • Most analytics tools fail GDPR because they store IP addresses or require cookies
  • Sealmetrics stores no personal data, which puts the dataset outside the GDPR's material scope (Recital 26) rather than inside it with a justification attached
  • Country-specific regulations (TTDSG, CNIL) have additional requirements beyond baseline GDPR

What Makes Analytics GDPR Compliant?​

GDPR compliance for web analytics rests on three fundamental pillars established by the General Data Protection Regulation.

The Three Pillars of Compliance​

Legal Basis (Article 6): Every processing activity involving personal data requires a lawful basis. For analytics that touches personal data, that means consent or legitimate interest. There is also a third position, which most vendors skip past: if no personal data is stored, Article 6 does not apply at all. Which of the three you're in determines whether you need a cookie banner and how much data you keep.

Data Minimization (Article 5): You can only collect data that's adequate, relevant, and limited to what's necessary. This principle prohibits collecting unnecessary identifiers, storing full IP addresses without justification, or retaining data longer than needed.

Privacy by Design (Article 25): Analytics must implement technical and organizational measures to protect user privacy from the design stage. This includes pseudonymization, encryption, and default privacy-protective configurations.

Most analytics tools fail on at least one of these pillars. Google Analytics fails on legal basis (requires consent due to cookies and US transfers). Plausible and Matomo store hashed IP addresses, creating questions under data minimization. Sealmetrics was built specifically to satisfy all three pillars simultaneously.

GDPR Article 6 defines six legal bases for processing personal data. For web analytics, two get used — consent and legitimate interest. But the question that comes first, and usually gets skipped, is whether you are processing personal data at all. If you aren't, Article 6 never enters the picture.

Consent (Article 6(1)(a)) - The Problem​

Consent means users must actively opt in before any tracking occurs. This approach sounds simple but creates severe practical problems.

The Data Loss Problem: Studies across the EU show consistent patterns. In Germany, 87% of users reject cookie banners according to 2024 CNIL data. In France, rejection rates hover around 73%. Spain and Italy show similar patterns at 68-72%.

Be careful how you translate those into a data loss figure — a rejection rate is measured among the people who engaged with the banner, and it is not your loss rate. Consent Mode v2 models part of the unconsented traffic back in as estimates, and visitors who ignore a banner on one visit sometimes accept on the next. What actually reaches your reports is a shortfall of 15-60%, depending on your sector, the strength of your brand and where your traffic comes from. A recognised consumer brand serving mostly direct traffic sits near 15%; a site buying cold traffic in a privacy-sensitive vertical sits near 60%.

Implementation Complexity: Consent requires explicit, informed, freely given agreement. Your cookie banner must clearly explain what data you collect, why you collect it, and allow granular control. Users must be able to withdraw consent as easily as they gave it. For analytics that span multiple sessions, you need to manage consent state across visits, handle consent withdrawal, and delete historical data on request.

Legal Requirements: Consent must be documented, time-stamped, and provable. You need systems to track who consented, when they consented, what they consented to, and whether consent is still valid. This creates significant technical and legal overhead.

Legitimate Interest (Article 6(1)(f)) - The Popular Answer​

Legitimate interest allows processing when your business needs are not overridden by user privacy rights. It is what most privacy-conscious analytics vendors reach for, and for a tool that stores hashed IPs or any other identifier, it is often the right answer.

The Balancing Test: you weigh your business interest against user rights, document the reasoning, and keep it on file for the day someone asks.

Your Interest: understanding how visitors use your website to improve user experience, optimize content, and make informed business decisions.

User Impact: minimal when analytics is cookieless, stores no IP addresses, and implements data minimization.

Result: for tools that do process some personal data, the balancing test can come out in your favour, and no consent is required.

But notice what invoking it costs you. Naming any Article 6 basis is an admission that you are processing personal data — you are simply arguing that you're entitled to. Once you've said that, every downstream obligation follows: data subject rights over that data, the right to object under Article 21, records of processing, the balancing test you now have to defend. You have won the consent argument by conceding the bigger one.

No Legal Basis Required - The Stronger Position​

There is a prior question, and it is the one worth asking: is there personal data here at all?

GDPR Recital 26 is explicit that the principles of data protection do not apply to anonymous information — information which does not relate to an identified or identifiable natural person. If your analytics stores nothing that identifies a person, the dataset falls outside the material scope of the Regulation. Article 6 is never reached, because Article 6 governs the processing of personal data and there isn't any.

ePrivacy Article 5(3) is the separate rule that actually mandates cookie banners. It requires consent to store information on, or gain access to information stored in, a user's terminal equipment. This one is not about personal data at all — it applies to anything written to or read from the device. A tool that writes nothing and reads nothing never triggers it.

Both have to hold. Clear one and fail the other and you still need a banner.

When this position applies: to cookieless analytics like Sealmetrics that:

  • Collect only necessary data (pageviews, sessions, referrers)
  • Store no personally identifiable information — no IP addresses, not even hashed
  • Write nothing to the device: no cookies, no LocalStorage, no persisted fingerprint
  • Don't use data for other purposes (advertising, profiling)
  • Retain aggregates for reasonable periods (24 months for trend analysis)

CNIL 2020 Guidance: the French data protection authority published guidance stating that audience measurement can operate without consent when it "strictly respects users' privacy," specifying no cross-site tracking, limited retention, no IP storage, and transparency in privacy policies. Worth stating plainly: CNIL does not certify or approve individual analytics tools, and neither does any other supervisory authority. No such scheme exists. What exists is guidance you can assess yourself against — see our CNIL self-assessment.

Unlike consent-based approaches, this removes the 15-60% consent gap entirely — and it does so without asking a regulator to accept a balancing test.

The GDPR Compliance Checklist​

Implementing GDPR compliant analytics requires addressing technical, legal, and organizational requirements.

Technical Requirements​

No Unnecessary Data Collection: Collect only what's needed for analytics. Sealmetrics tracks pageviews, sessions, referrers, device types, and basic engagement metrics. We don't collect names, emails, precise locations, or other unnecessary identifiers.

IP Address Handling: This is where most analytics tools fail GDPR. Google Analytics stores full IP addresses. Plausible and Matomo hash IP addresses, which GDPR still considers personal data because hashed values can be reversed or matched. Sealmetrics never stores IP addresses—not even hashed versions. Our session-based tracking generates anonymous identifiers that can't be traced back to individuals.

Data Retention Limits: Determine legitimate retention periods and enforce them. Sealmetrics defaults to 24 months of retention, documented as necessary for year-over-year trend analysis and seasonal pattern identification. Data older than 24 months is automatically purged.

Security Measures: Implement encryption in transit (HTTPS), encryption at rest, access controls, and regular security audits. Sealmetrics uses AES-256 encryption, role-based access control, and annual penetration testing.

Privacy Policy: Your privacy policy must explain what analytics you use, what data gets collected, how long it is retained, and on what footing you operate. If you rely on legitimate interest, document your balancing test. If you store no personal data at all, say so plainly and explain why no consent is required.

Legal Position Documentation: Maintain internal documentation for whichever footing you're on. If you rely on legitimate interest, document: (1) what business purpose the analytics serves, (2) why this data is necessary, (3) how you minimize privacy impact, and (4) what safeguards you implement. If you're claiming the data is out of scope, document what is stored field by field and why none of it identifies a person.

Data Processing Agreement (DPA): GDPR Article 28 requires a DPA between you and your analytics provider. Sealmetrics provides a standard DPA covering all processor obligations including security, confidentiality, sub-processor management, and data deletion.

Data Protection Impact Assessment (DPIA): Required when processing presents high risk to user rights. Cookieless analytics typically don't require DPIA because they implement data minimization and have minimal privacy impact. However, document why you determined DPIA isn't needed.

Organizational Requirements​

Internal Documentation: Maintain records of processing activities under GDPR Article 30. Document what analytics you use, why, what legal basis applies, what data gets processed, and where data is stored.

Staff Training: Ensure team members understand GDPR requirements, know how to handle data requests, and follow privacy procedures.

Incident Response Plan: Establish procedures for handling potential data breaches, including detection, assessment, notification to authorities within 72 hours if required, and user notification when appropriate.

Tools Comparison: GDPR Compliance​

Understanding how different analytics tools handle GDPR compliance helps you choose the right solution for your needs.

FeatureGoogle AnalyticsPlausibleMatomoSealmetrics
Legal BasisConsent requiredLegitimate interestLegitimate interestNone needed — no personal data (Recital 26)
Cookie UsageYes (multiple)NoOptionalNo
IP StorageYes (full)Yes (hashed)Yes (hashed)No - zero IPs
Consent Banner NeededYesNo*No*No
Data LocationUS + EUEU onlySelf-hosted or EUEU only
Consent-driven data loss15-60%None where consent isn't requiredNone where consent isn't requiredNone
US Data TransfersYesNoNoNo
Schrems II CompliantQuestionableYesYesYes
CNIL 2020 CompliantNoWith configWith configYes (default)
TTDSG Compliant (Germany)NoYesYesYes
Setup ComplexityHighLowMediumVery Low (2 min)
DPA IncludedYesYesYesYes

*May need consent depending on configuration and cookie usage

The table reveals a critical insight: tools that hash IP addresses (Plausible, Matomo) still process personal data under GDPR. Hashing is pseudonymization, not anonymization. Sealmetrics achieves true compliance by never storing IP addresses at all.

Why Most Analytics Tools Fail GDPR​

Three common failures plague analytics tools attempting GDPR compliance.

Problem 1: IP Address Storage​

GDPR defines personal data as any information relating to an identified or identifiable person. IP addresses clearly qualify as personal data according to multiple court rulings and regulatory guidance.

The Hashing Myth: Many analytics tools claim GDPR compliance by hashing IP addresses before storage. This creates a false sense of security. GDPR distinguishes between anonymization (irreversible, not personal data) and pseudonymization (reversible, still personal data). Hashed IPs are pseudonymized, not anonymized.

Why hashing doesn't solve the problem:

  • Hash algorithms can be reversed with rainbow tables
  • Hashed values can be matched across systems
  • Same IP produces same hash, enabling tracking
  • GDPR Recital 26 explicitly states pseudonymization doesn't remove personal data status

Schrems II Implications: The Schrems II decision invalidated Privacy Shield, making US data transfers problematic. Many companies responded by hosting analytics in the EU, but if those tools store IP addresses (even hashed), they still process personal data requiring careful legal basis justification.

Sealmetrics solves this by never storing IP addresses. Our session tracking uses temporary identifiers that reset after each visit, making reverse-identification technically impossible.

The ePrivacy Directive Article 5(3)—often called the Cookie Law—requires consent before storing information on user devices. This operates alongside GDPR, creating a dual compliance requirement.

The Cookie Consent Trap: Analytics tools using cookies face an impossible choice. They can require consent and lose 15-60% of their data, or operate without consent and violate the ePrivacy Directive. Many companies choose the latter, hoping enforcement remains limited.

Technical Cookies Exemption: The ePrivacy Directive exempts "strictly necessary" cookies for functionality users explicitly request. Analytics cookies don't qualify for this exemption according to regulatory consensus. The upcoming ePrivacy Regulation will likely remove any remaining ambiguity.

Sealmetrics avoids this problem entirely through cookieless tracking. No cookies means no ePrivacy Directive concerns, no consent banners, and no data loss from rejections.

Problem 3: US Data Transfers​

Google Analytics stores data in US servers, creating complex legal challenges post-Schrems II.

Why This Matters: Schrems II invalidated the Privacy Shield framework that allowed EU-US data transfers. The Court ruled that US surveillance laws (FISA 702, EO 12333) don't provide adequate protection for EU citizen data. While a new adequacy decision was adopted in July 2023, uncertainty remains about its long-term validity.

The Google Problem: Multiple European data protection authorities (Austria, France, Italy) have ruled that Google Analytics violates GDPR due to US data transfers. Even with Google's EU hosting options, the underlying data sharing with Google's US operations creates compliance risks.

Sealmetrics operates exclusively on EU infrastructure with no US parent company, eliminating data transfer concerns entirely.

How Sealmetrics Handles GDPR​

Sealmetrics was built from the ground up around the GDPR, not retrofitted like most analytics tools.

Sealmetrics needs no cookie consent banner, for two independent reasons. Nothing is stored on or read from the user's device, so ePrivacy Article 5(3) — the rule that mandates banners — is never triggered. And no personal data is stored, so the dataset falls outside the GDPR's material scope under Recital 26 and needs no Article 6 legal basis at all. That removes the 15-60% consent gap at its source.

The Technical Foundation: Our session-based tracking generates temporary identifiers that exist only for the duration of a visit. When a user leaves your site, the identifier expires. When they return, a new identifier is generated. This prevents cross-session tracking while still providing valuable analytics on how users navigate your site within individual visits.

CNIL Compliance: The French data protection authority's 2020 guidance on analytics explicitly allows this approach. CNIL confirms that audience measurement without consent is permissible when analytics strictly respect user privacy through technical safeguards like cookieless tracking and no IP storage.

No Fingerprinting: Unlike some cookieless analytics that use browser fingerprinting (tracking users via unique browser characteristics), Sealmetrics uses simple session identifiers. Fingerprinting is considered personal data processing under GDPR and requires consent. Our approach avoids this entirely.

Zero IP Storage​

This is Sealmetrics' most significant differentiator. We don't store IP addresses—not full, not truncated, not hashed, not at all.

How It Works: When a pageview hits our servers, we process the request, extract necessary analytics data (page URL, referrer, timestamp), and use the IP address only transiently server-side for security and anti-abuse checks. The IP never touches our analytics database and is never linked to any hit or metric — it appears only in short-lived operational logs with limited retention.

Contrast with Competitors:

  • Google Analytics: Stores full IP addresses by default (can be configured for anonymization but still processes full IPs)
  • Plausible: Hashes IP addresses before storage
  • Matomo: Offers IP anonymization but defaults to storing IP addresses
  • Sealmetrics: Zero IP storage, not even hashed

This technical choice means Sealmetrics stores less personal data than any competitor — none — which is what keeps the dataset outside the Regulation's scope instead of merely defensible inside it.

Data retention limits are crucial for GDPR compliance under the data minimization principle. Sealmetrics retains analytics data for 24 months, a period we've documented as necessary for meaningful trend analysis.

Why 24 Months: This retention period allows:

  • Year-over-year comparisons (12 months of current data + 12 months historical)
  • Seasonal pattern identification (requires full annual cycles)
  • Long-term trend analysis for strategic decisions
  • Buffer period for data exports and migrations

Automatic Purging: Data older than 24 months is automatically deleted from our systems. No manual intervention needed, no risk of keeping data too long.

Documented Justification: We maintain internal documentation explaining why 24-month retention is necessary for business intelligence and user experience optimization, and confirming that what is retained is aggregate data containing no personal identifiers.

EU Infrastructure​

Sealmetrics operates exclusively on European infrastructure, eliminating Schrems II concerns.

Data Location: All Sealmetrics servers are located in an EU data center in Dublin, Ireland. Customer data never leaves the European Union. Our company is EU-based with no US parent organization or data sharing agreements with US entities.

Processor Compliance: Our subprocessor list is deliberately short — infrastructure and database hosting in Ireland, managed LLM inference in Paris for the optional Seal AI Private add-on, and a transactional email provider. The authoritative, always-current list is Annex 3 of our DPA, which also sets out the notification procedure if processors change. If you use LENS with your own LLM key instead, that provider is your contract, not our subprocessor.

No Surveillance Exposure: Because we operate entirely within the EU legal framework, customer data isn't subject to US surveillance laws (FISA 702, EO 12333) that caused Schrems II complications for US-based analytics providers.

Country-Specific GDPR Considerations​

While GDPR provides baseline requirements across the EU, individual countries have additional regulations affecting analytics.

Germany (TTDSG)​

Germany's Telecommunications Telemedia Data Protection Act (TTDSG) is stricter than baseline GDPR regarding cookies and tracking.

Key Requirements:

  • Consent required for storing information on devices (including cookies)
  • Higher bar for "technically necessary" exemptions
  • Specific rules around telecommunications data
  • Fines up to €300,000 for violations

Sealmetrics Compliance: TTDSG changes nothing for Sealmetrics users because we don't use cookies or device storage. Our cookieless approach satisfies TTDSG requirements without configuration changes.

France (CNIL)​

The French data protection authority (Commission Nationale de l'Informatique et des Libertés) published influential guidance on analytics in 2020.

CNIL 2020 Analytics Guidance: This document established that "audience measurement" can operate without consent under specific conditions:

  • Purpose limited to measuring audience
  • No cross-site tracking
  • No data sharing with third parties for other purposes
  • Limited retention periods
  • Transparent privacy disclosures

Exemption Categories: CNIL identifies two types of exempt audience measurement:

  1. First-party audience measurement (tracking on your own site)
  2. Delegated audience measurement (using analytics providers like Sealmetrics)

Sealmetrics Qualification: Sealmetrics explicitly qualifies for CNIL's delegated audience measurement exemption. We meet all specified requirements: purpose limitation, no cross-site tracking, documented retention limits, EU-only operation, and clear privacy disclosures.

Spain (AEPD)​

Spain's data protection authority (Agencia Española de Protección de Datos) follows similar principles to CNIL with emphasis on data minimization.

Key Focus Areas:

  • Proportionality of data collection
  • Technical necessity justification
  • User transparency requirements
  • Cross-border data transfer restrictions

Implementation: Spanish companies using Sealmetrics should document in their privacy policies why no personal data is stored — no IPs, no cookies, minimal collection — rather than asserting a legal basis they don't need.

Implementation Guide​

Moving to GDPR compliant analytics involves choosing your legal basis, implementing technical measures, updating legal documentation, and verifying compliance.

The first decision determines everything else — and it starts one question earlier than most teams assume.

Decision Tree:

Does your analytics store any personal data
(IP addresses, hashed or not, user IDs, persistent identifiers)?
│
├─ No, and it writes nothing to the device
│  └─ No Article 6 basis needed (Recital 26)
│     No consent needed (ePrivacy 5(3) not engaged)
│     └─ Choose Sealmetrics or a similar truly cookieless tool
│
└─ Yes → you are inside the GDPR, so pick a basis:
   │
   ├─ Consent → implement a cookie banner
   │  └─ Accept 15-60% data loss, unevenly distributed
   │
   └─ Legitimate interest → run and document a balancing test
      └─ Accept the obligations that come with processing personal data

Out-of-scope checklist — every answer must be yes:

  • Are you certain no IP address is stored, in any form, including hashed?
  • Is nothing written to or read from the user's device (no cookies, no LocalStorage, no persisted fingerprint)?
  • Are all identifiers session-scoped and never correlated across visits?
  • Is the retained data aggregate, with no field that could single out a person?
  • Can you show all of the above to a DPO in writing?

If any answer is no, you are processing personal data and you need a legal basis. Don't assert the out-of-scope position on a tool that doesn't earn it.

Step 2: Technical Setup​

Implementation differs by platform but follows similar principles.

That's it. No cookie configuration, no IP anonymization settings, no consent management. The script loads asynchronously, doesn't block page rendering, and starts capturing analytics immediately.

For Other Platforms:

  • Remove or configure cookie-based tracking
  • Enable IP anonymization (though this doesn't fully solve GDPR issues)
  • Disable advertising features
  • Disable user ID tracking
  • Configure EU-only data storage

Update three key documents to reflect your analytics approach.

Privacy Policy Updates:

Add or update your analytics section:

We use Sealmetrics for web analytics. Sealmetrics collects anonymous
usage data (pages viewed, referral sources, aggregate engagement)
without cookies and without storing IP addresses. Nothing is stored
on or read from your device. Because no personal data is retained,
this measurement falls outside the scope of the GDPR and requires
no consent. Data is retained for 24 months for trend analysis and
stored exclusively on EU servers in Dublin, Ireland. You can opt
out via [opt-out link].

Out-of-Scope Documentation (Internal):

Maintain internal records documenting:

  • What is stored, field by field, and why no field identifies a person
  • That nothing is written to or read from the device, so ePrivacy Article 5(3) is not engaged
  • Why the dataset is anonymous rather than pseudonymous, with reference to Recital 26
  • Safeguards: cookieless, IP-less, EU-only, limited retention
  • Alternative considered: consent-based analytics rejected due to 15-60% data loss

Data Processing Agreement:

Execute Sealmetrics' standard DPA, which covers:

  • Processor obligations (security, confidentiality, instructions)
  • Sub-processor authorization and notification
  • Data subject rights assistance
  • Data breach notification procedures
  • Post-termination data deletion
  • Audit rights

Step 4: Verify Compliance​

After implementation, verify everything works correctly.

Technical Verification:

  • Open browser developer tools → Application → Cookies
  • Confirm: No analytics cookies set
  • Check: Privacy policy updated
  • Test: Analytics dashboard receiving data
  • Verify: Opt-out mechanism functions

Legal Verification:

  • Privacy policy describes the analytics accurately, including why no consent is required
  • DPA executed with Sealmetrics
  • Internal out-of-scope documentation complete (what is stored, and why none of it is personal data)
  • Data retention schedule understood (fixed 24 months for aggregates and conversions)
  • Team trained on data handling procedures

Ongoing Compliance:

  • Review analytics configuration quarterly
  • Update documentation when practices change
  • Monitor regulatory guidance for updates
  • Conduct annual GDPR compliance audit

Common GDPR Compliance Mistakes​

Avoiding these frequent errors saves legal headaches and potential fines.

The Problem: Consent sounds legally safe but creates massive business problems. Rejection rates in the EU run as high as 87%, and the resulting shortfall in your reports is 15-60% — spread unevenly across your channels, which is what quietly reorders your rankings rather than just shrinking your totals.

Why It Happens: Companies fear legitimate interest is too uncertain or worry about regulatory challenges. They choose consent thinking it's the "safer" option.

The Fix: use a properly implemented cookieless tool that stores no personal data, so no Article 6 basis is required in the first place. Document what is stored and why none of it identifies a person, minimize collection, and implement technical safeguards.

Mistake 2: Using Google Analytics Without Configuration​

The Problem: Default Google Analytics configuration violates GDPR in multiple ways: sets cookies without consent, stores IP addresses, transfers data to US servers, and enables advertising features.

Why It Happens: Companies install Google Analytics with default settings, assuming a major tech company must be GDPR compliant by default. This assumption is incorrect.

The Fix: either configure Google Analytics extensively (IP anonymization, cookie consent integration, disable advertising, EU-only hosting) and accept 15-60% data loss from consent requirements, or switch to Sealmetrics and avoid the gap altogether.

Mistake 3: Thinking Hashed IPs Solve GDPR​

The Problem: Many analytics tools claim GDPR compliance by hashing IP addresses before storage. This is pseudonymization, not anonymization. GDPR still considers pseudonymized data as personal data.

Why It Happens: Marketing materials from analytics vendors incorrectly conflate hashing with anonymization. Companies believe "we hash IPs" means "we don't process personal data."

The Fix: Use analytics that doesn't store IP addresses at all. Sealmetrics never stores IPs—not hashed, not truncated, not at all. This eliminates the personal data processing question entirely.

Mistake 4: No DPA with Analytics Provider​

The Problem: GDPR Article 28 requires a Data Processing Agreement between controllers (you) and processors (your analytics provider). Operating without a DPA is a compliance violation regardless of how privacy-protective your analytics tool is.

Why It Happens: Small companies often overlook this administrative requirement, focusing only on technical compliance.

The Fix: Execute a DPA with your analytics provider. Sealmetrics provides a standard DPA to all customers covering all Article 28 requirements.

Mistake 5: Inadequate Privacy Policy Disclosures​

The Problem: GDPR Article 13 requires transparent information about data processing. Many companies mention "we use analytics" without explaining what data is collected, what legal basis applies, or how long data is retained.

Why It Happens: Companies copy privacy policy templates without customizing them for their specific analytics implementation.

The Fix: clearly disclose in your privacy policy what analytics you use, what specific data gets collected, where it is stored, how long it is retained, why no consent is required, and how users can opt out. See Step 3 above for specific language.

Expert Perspectives on GDPR Analytics​

Regulatory guidance and legal opinions provide authoritative views on compliant analytics implementation.

CNIL (French Data Protection Authority)​

In their groundbreaking 2020 guidance on audience measurement, CNIL stated:

"Audience measurement can be performed without consent when it strictly respects users' privacy and is limited to producing anonymous statistical data."

CNIL's guidance establishes specific requirements:

  • Purpose limitation to audience measurement only
  • No cross-site tracking or user profiling
  • Limited data retention periods (maximum 24 months mentioned)
  • No IP address storage beyond immediate processing needs
  • Transparent privacy policy disclosures

This guidance forms the foundation for consent-exempt audience measurement across the EU, as other data protection authorities have referenced CNIL's framework in their own. Note the wording CNIL uses: anonymous statistical data. That is a statement about the nature of the output, not about having a good reason to process personal data.

GDPR Article 5(1)(c) - Data Minimization​

The regulation itself provides clear direction:

"Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed."

For analytics, this means:

  • Collect only essential metrics (pageviews, sessions, referrers)
  • Don't collect unnecessary identifiers (names, emails, precise locations)
  • Don't store IP addresses if your technical approach doesn't require them
  • Don't retain data longer than necessary for your documented purposes

Sealmetrics implements data minimization as a core design principle. We collect the minimum data necessary for meaningful analytics: what pages users visit, how they navigate, where they came from, and basic device information. We don't collect anything else.

The Sealmetrics Approach​

Unlike cookie-based analytics tools that retrofit GDPR compliance onto existing architectures, Sealmetrics was designed from inception for compliance.

No Compromise Required: Traditional analytics forces a choice between a clean legal position and complete data. Cookie consent buys the former at the cost of 15-60% of the latter. Sealmetrics measures every visit and keeps the legal position clean, through:

  1. Cookieless Architecture: No cookies means no ePrivacy Directive concerns, no consent requirements, no data loss from rejections.

  2. Zero IP Storage: Not hashing, not truncating—zero storage. IP addresses never touch our database, eliminating the largest GDPR compliance question.

  3. Session-Based Tracking: Temporary identifiers that reset after each visit provide analytics value without enabling cross-session tracking or user identification.

  4. EU-Exclusive Operation: Servers, company, and data all in the EU. No US parent, no Schrems II concerns, no adequacy decision dependencies.

  5. Purpose Limitation: Sealmetrics processes data only for audience measurement. No advertising integrations, no data selling, no repurposing for other commercial activities.

  6. Documented Retention: 24-month retention justified and documented as necessary for trend analysis, with automatic purging of older data.

This technical foundation is what puts the dataset outside the GDPR's material scope rather than inside it needing a justification — consistent with CNIL's guidance, and accepted by DPOs across the EU. To be clear about what that is and isn't: DPO acceptance is a customer assessment, not a regulatory endorsement. No supervisory authority certifies analytics tools, and SealMetrics holds no ISO 27001 or SOC 2 certification.

Frequently Asked Questions​

Is Google Analytics GDPR compliant?​

Google Analytics is not GDPR compliant in its default configuration. Multiple European data protection authorities (Austria, France, Italy) have ruled that standard Google Analytics implementations violate GDPR due to three main issues:

First, Google Analytics uses cookies, triggering ePrivacy Directive consent requirements. This means you need cookie banners and will lose 15-60% of your data to ghosting and rejection.

Second, Google Analytics stores IP addresses. Even with the IP anonymization feature enabled, full IPs are processed before anonymization occurs, constituting personal data processing.

Third, Google Analytics transfers data to US Google servers, creating Schrems II compliance challenges. While Google offers a consent mode and EU hosting options, the fundamental architecture involves data sharing with a US parent company.

You can make Google Analytics more GDPR compliant through extensive configuration, but you'll still need consent banners and accept massive data loss. Sealmetrics provides compliance without these compromises.

Yes, with properly implemented cookieless analytics like Sealmetrics. Cookie banners are required by the ePrivacy Directive when websites store information on user devices (cookies). If your analytics doesn't use cookies, no banner is needed.

The GDPR is a separate question from ePrivacy, and both have to be satisfied. Sealmetrics satisfies both: nothing is stored on or read from the device (so ePrivacy Article 5(3) is not engaged), and no personal data is stored (so the dataset sits outside the GDPR's material scope under Recital 26, with no Article 6 basis required).

This measures every visit without a consent banner — and without asking anyone to accept a balancing test.

Consent (Article 6(1)(a)) requires users to actively opt in before processing begins. For analytics that means cookie banners, explicit checkboxes, and a 15-60% hole in your data.

Legitimate interest (Article 6(1)(f)) allows processing when your business needs are not overridden by privacy rights. It's the right answer for a tool that stores hashed IPs or other identifiers, provided the purpose is audience measurement rather than advertising, collection is minimized, safeguards are in place, and users can object.

The third option is the one people miss. Both of the above assume you're processing personal data. If your analytics stores none — no IP in any form, no persistent identifier, nothing written to the device — then under Recital 26 the dataset is outside the GDPR's material scope and no Article 6 basis is required at all.

That is a stronger position, not a weaker one, and it's why Sealmetrics does not claim legitimate interest. Claiming 6(1)(f) would concede that personal data is being processed. CNIL confirmed in 2020 that cookieless audience measurement can operate without consent when it produces anonymous statistical data — which is the same distinction.

Does hashing IP addresses make them anonymous under GDPR?​

No. Hashing IP addresses is pseudonymization, not anonymization. GDPR treats pseudonymized data as personal data requiring the same protections as unprocessed personal data.

GDPR Recital 26 explicitly states: "Personal data which have undergone pseudonymization, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person."

Hashed IPs remain personal data because:

  • Hash functions can be reversed with rainbow tables
  • Same IP produces same hash, enabling tracking
  • Hashes can be matched across systems
  • Technical possibility of re-identification exists

Sealmetrics solves this by never storing IP addresses—not hashed, not truncated, zero storage. This eliminates the personal data question entirely.

How long can I store analytics data under GDPR?​

GDPR doesn't specify exact retention periods but requires you to keep data only as long as necessary for documented purposes. For analytics, retention depends on your business justification.

CNIL's 2020 guidance mentions 24 months as an acceptable retention period for audience measurement, justified by the need for year-over-year comparisons and seasonal pattern identification.

Sealmetrics implements 24-month retention with documented justification:

  • 12 months of current data for analysis
  • 12 months of historical data for year-over-year comparison
  • 1 month buffer for data exports and migrations
  • Automatic deletion after 24 months

Your privacy policy should specify retention periods, and you should maintain internal documentation justifying why these periods are necessary for your stated purposes.

Do I need a Data Processing Agreement (DPA) with my analytics provider?​

Yes. GDPR Article 28 requires a written contract between data controllers (you) and data processors (your analytics provider) establishing:

  • Subject matter and duration of processing
  • Nature and purpose of processing
  • Type of personal data processed
  • Categories of data subjects
  • Obligations and rights of the controller

The DPA must include specific processor obligations around security, confidentiality, sub-processor management, data subject rights assistance, data breach notification, and post-termination data handling.

Sealmetrics provides a standard DPA to all customers covering all Article 28 requirements. Operating without a DPA violates GDPR regardless of how privacy-protective your analytics tool is.

What is a Data Protection Impact Assessment (DPIA) and do I need one?​

A DPIA is a systematic analysis required under GDPR Article 35 when processing is "likely to result in high risk to the rights and freedoms of natural persons." DPIAs are mandatory for:

  • Systematic and extensive profiling with significant effects
  • Large-scale processing of special category data
  • Systematic monitoring of publicly accessible areas at large scale

Most cookieless analytics don't require DPIA because they implement data minimization, don't create detailed user profiles, and have minimal privacy impact. However, you should document your reasoning for not conducting a DPIA.

If your DPO or legal counsel determines a DPIA is needed, the assessment should document: description of processing operations, necessity and proportionality assessment, risk analysis, and mitigation measures.

Sealmetrics' technical approach (no IPs, no cookies, minimal data, EU-only) creates low privacy impact, typically not requiring DPIA. Many customers document this determination as part of their compliance records.

Can I use Sealmetrics for TTDSG compliance in Germany?​

Yes, Sealmetrics complies with Germany's TTDSG (Telecommunications Telemedia Data Protection Act) without requiring configuration changes.

TTDSG is stricter than baseline GDPR, particularly regarding device storage and tracking. The law requires consent for storing information on devices (including cookies) with limited exemptions for technically necessary functionality.

Sealmetrics complies because:

  • No cookies or device storage (eliminates consent requirement)
  • No fingerprinting or tracking technologies (avoids TTDSG tracking restrictions)
  • Data minimization by design (satisfies TTDSG privacy principles)
  • EU-exclusive operation (no German-US data transfer concerns)

German companies using Sealmetrics operate without cookie banners because §25 TTDSG governs storing and reading information on devices, and Sealmetrics does neither. Every visit is measured, with no consent gate to fail.

What if my Data Protection Officer (DPO) rejects cookieless analytics?​

DPOs sometimes push back on cookieless analytics out of unfamiliarity with the framework — and, fairly often, because a previous vendor oversold it. Address this by providing:

CNIL 2020 Guidance: share the French DPA's documentation confirming that audience measurement can operate without consent when it produces anonymous statistical data. Be precise about what this is: guidance you can assess yourself against, not a certification. CNIL does not approve individual tools.

Technical Documentation: explain the implementation — no cookies, zero IP storage, session-scoped identifiers never written to the device, EU-only servers in Dublin. This is what carries the argument, so lead with it.

The Scope Argument, Not a Balancing Test: don't present a legitimate interest analysis. Present why there is no personal data in the dataset, field by field, and therefore why Recital 26 puts it outside the Regulation's material scope. A DPO who has seen a dozen weak balancing tests will find this a refreshing change.

Comparison with Alternatives: show that consent-based analytics loses 15-60% of its data, unevenly across channels. Resist inflating it — a DPO who catches an exaggerated number will discount everything else you said.

Most DPOs approve once they understand the legal framework and technical implementation. If concerns remain, consider requesting a second opinion from external GDPR counsel or consulting other DPOs in your industry who have approved similar approaches.

How do I document a consentless analytics setup?​

GDPR doesn't prescribe documentation formats, but the records worth keeping are these:

Purpose Statement: "We measure website usage in order to understand how visitors navigate our site, enabling user experience improvements and informed business decisions."

Scope Analysis — the important one:

  • What is stored: pages viewed, referrer, aggregate engagement, country derived from browser timezone
  • What is not stored: IP addresses in any form including hashed, user IDs, cross-session identifiers
  • Device storage: none — no cookies, no LocalStorage, nothing written or read
  • Conclusion: the dataset does not relate to an identified or identifiable natural person, so under Recital 26 it falls outside the material scope of the GDPR, and no Article 6 legal basis is required

Safeguards: cookieless, zero IP storage, EU servers in Dublin, 24-month retention on aggregates with automatic purging.

Alternative Considered: "We considered consent-based analytics but rejected it because 15-60% data loss from banner ghosting and rejection would prevent achieving our business intelligence purposes."

Opt-Out Mechanism: "Users can opt out via [provide opt-out method]."

Sealmetrics provides documentation templates to help customers formalize this for internal records and DPO review.

Conclusion​

GDPR compliance for web analytics doesn't require choosing between legal safety and data completeness. The consent-or-data-loss dilemma is a false choice created by outdated cookie-based analytics architectures.

The path to a clean legal position without giving up 15-60% of your data:

  1. Ask the prior question: is any personal data stored at all? If not, no Article 6 basis is needed
  2. Implement truly cookieless analytics that writes nothing to and reads nothing from the device
  3. Ensure zero IP storage—not hashed or truncated, but zero storage
  4. Document your approach: what is stored, and why none of it identifies a person
  5. Update your privacy policy with clear, specific disclosures
  6. Execute a DPA with your analytics provider

Sealmetrics satisfies all of these by default:

  • No consent required: nothing stored on the device (ePrivacy 5(3) not engaged), no personal data stored (outside GDPR material scope, Recital 26)
  • No cookies: no ePrivacy exposure and no consent-driven data loss
  • Zero IP storage: not even hashed—the primary personal data question doesn't arise
  • No consent gap: every visit measured, rather than the 40-85% a banner lets through
  • EU-exclusive: analytics data hosted in Dublin, Ireland. No Schrems II complications
  • 24-month retention: documented as necessary for trend analysis, with automatic purging

Stop compromising between compliance and complete analytics data.

Start your 14-day free trial: Sealmetrics.com

Additional Resources​