Skip to main content

Long-Term Analytics: 24-Month Data Retention Without Consent

· 15 min read
Rafael Jimenez
Rafael Jimenez
Founder & CEO at Sealmetrics

TL;DR — 24-month analytics data retention without consent. How cookieless tracking enables long-term analysis with a design built to comply with the GDPR.

Understanding long-term user behavior is crucial for business growth, but traditional analytics platforms face a critical limitation: GDPR requires deleting data after consent expires, typically forcing 6-13 month retention limits. Sealmetrics solves this with cookieless tracking that enables 24-month data retention without requiring user consent.

Key Takeaways​

  • 24-month retention without consent: Sealmetrics stores aggregated, non-identifying analytics for two years; the per-hit log is purged after one day
  • No consent expiration risk: Unlike cookie-based analytics, your data won't be deleted when consent expires
  • Complete historical analysis: Track seasonal trends, year-over-year growth, and long-term user behavior
  • Designed for GDPR: Cookieless tracking with zero IP storage meets data minimization requirements

The Data Retention Problem in Traditional Analytics​

Most analytics platforms face a fundamental challenge with GDPR compliance: cookie consent expires, and when it does, you must delete all associated data.

Google Analytics and similar cookie-based platforms require user consent under GDPR Article 5(3) of the ePrivacy Directive. This creates several problems:

  1. Consent expires after 6-13 months (depending on implementation)
  2. Data deletion is mandatory when consent expires or is withdrawn
  3. Historical analysis becomes impossible beyond the consent window
  4. Year-over-year comparisons fail because data older than consent period must be deleted

According to CNIL guidelines from 2024, cookie-based analytics platforms must implement consent expiration and data deletion mechanisms. This means businesses lose valuable historical insights simply because the legal basis (consent) expires.

The Business Impact of Short Data Retention​

Limited data retention affects critical business decisions:

  • Seasonal analysis: Can't compare Q4 2023 to Q4 2024 if consent expired
  • Customer lifecycle: Incomplete view of customer journey beyond consent period
  • Attribution modeling: Can't track conversions that occur 12+ months after first visit
  • Trend identification: Missing long-term patterns that only emerge over years
  • ROI calculation: Incomplete data for marketing channels with long conversion cycles

In B2B SaaS, where sales cycles often exceed 6 months, this data retention limitation can cripple analytics entirely.

How Sealmetrics Enables 24-Month Data Retention​

Sealmetrics stores nothing on the device and no data that identifies anyone, and what it keeps long-term is aggregated.

The only identifier Sealmetrics handles is a session identifier that is pseudonymised data while its key and daily salt exist (GDPR Recital 26). The salt rotates daily and the old one is destroyed, after which not even Sealmetrics can reconstruct the identifier, and the per-hit log is purged after one day. What is kept for 24 months is aggregated reports, which are non-identifying.

Sealmetrics is in that position because:

  1. No identifying data stored: no IP addresses, no stored fingerprints, no cross-site identifiers
  2. Session-based tracking: the session identifier is computed in the browser, never written to the device, and re-keyed daily on the server so it cannot be linked across days
  3. Data minimization: only aggregate behavioural data, no individual profiles
  4. Transparent processing: a clear privacy policy explains what is measured

For the short-lived pseudonymised operational data (per-hit log, live session, one day), Sealmetrics relies on legitimate interest, GDPR Article 6(1)(f). CNIL's 2020 guidance confirms that cookieless analytics which doesn't create persistent user profiles can operate without consent.

Technical Implementation: Minimal Data​

Unlike competitors that hash or pseudonymize IP addresses, Sealmetrics uses a dual tracking approach:

Session-Based Tracking:

  • Session identifier = an in-browser hash of standard device characteristics, re-keyed daily on the server with a salt that is then destroyed
  • Session-ID expires after ~2 hours of inactivity
  • No cross-session tracking by default
  • Unrecoverable after the daily rotation, not even by Sealmetrics

Isolated Hit Recording:

  • Each pageview = independent data point
  • No IP address storage (not even hashed)
  • No stored device fingerprint (the session hash is re-keyed daily and never stored as sent)
  • Aggregate patterns only

This architecture means the data we retain for 24 months contains zero personal identifiers, making it fundamentally different from cookie-based systems that must delete data when consent expires.

Why 24 Months Specifically?​

The 24-month retention period is strategically chosen:

  1. Two full years of data: Enables year-over-year comparisons and full seasonal cycles
  2. GDPR proportionality: Long enough for legitimate business needs, not excessive
  3. CNIL compliance: Deliberately below the 25-month ceiling CNIL sets for consent-exempt analytics

After 24 months, data is automatically purged from Sealmetrics systems. This automatic deletion demonstrates compliance with GDPR's storage limitation principle while providing maximum analytical value.

Comparison: Data Retention Across Analytics Platforms​

Here's how long-term analytics capabilities compare across major platforms:

FeatureGoogle AnalyticsPlausibleMatomoSealmetrics
Legal BasisConsent (Article 6(1)(a))Legitimate InterestLegitimate InterestLegitimate interest — minimal pseudonymised data, aggregated reports
Requires Consent BannerYesNoDependsNo
Maximum Retention (With Consent)14-26 monthsUnlimitedUnlimited24 months
Maximum Retention (Without Consent)0 months26 months26 months24 months
Data Deletion on Consent WithdrawalRequiredNot requiredNot requiredNot required
Stores IP AddressesYesHashedHashedZero IPs
Cross-Session TrackingYes (cookies)OptionalOptionalSession-only
Personal Data RiskHighMediumMediumMinimal (identifier unrecoverable after one day)
Year-Over-Year AnalysisIf consent maintainedYesYesYes
Setup ComplexityHigh (consent mgmt)LowMediumAbout 4 minutes

Key Insight: Sealmetrics is the only platform that combines zero IP storage with 24-month retention, providing long-term analytics on aggregated, non-identifying reports.

Implementation Guide: Enabling Long-Term Analytics​

Setting up Sealmetrics for 24-month data retention takes less than 5 minutes.

Step 1: Install Tracking Script​

Add the Sealmetrics script to your site:

<script src="https://t.sealmetrics.com/t.js?id=YOUR_ACCOUNT_ID" defer></script>

That's it. No consent banner configuration needed for Sealmetrics (our self-assessment).

Step 2: Understand the Retention Schedule​

Sealmetrics retention is fixed and identical for every plan, enforced by database TTLs: daily aggregates and conversions are kept 24 months, hourly aggregates 90 days, and the per-hit log 1 day. There is nothing to configure — and since what is kept for 24 months is aggregated and non-identifying, there's no compliance reason to shorten it. If you ever need data removed earlier (for example when closing an account), contact support.

Step 3: Access Historical Data​

Query data from the full 24-month period via API or dashboard:

// API example: Get pageviews for last 2 years
fetch('https://api.sealmetrics.com/v1/stats/pageviews', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    site_id: 'YOUR_SITE_ID',
    date_from: '2022-06-01',
    date_to: '2024-06-01',
    period: 'month'
  })
})
.then(response => response.json())
.then(data => console.log('24-month pageview trend:', data));

Step 4: Verify Compliance​

Check your privacy policy includes:

We use Sealmetrics, a cookieless analytics platform, to understand 
how visitors use our website. Sealmetrics:
- Does not use cookies or require consent banners
- Does not store IP addresses or personal identifiers
- Retains aggregated analytics data for 24 months
- Stores nothing on your device and no data that identifies anyone;
  the session identifier rotates daily and cannot be reconstructed

This minimal pseudonymised data is processed on the basis of our
legitimate interest (GDPR Art. 6(1)(f)). For more: https://sealmetrics.com/privacy

Use Cases: When Long-Term Analytics Matter​

Seasonal Business Analysis​

E-commerce sites with strong seasonal patterns need multi-year data:

Q4 2022 revenue: €150,000
Q4 2023 revenue: €180,000 (+20%)
Q4 2024 revenue: €225,000 (+25%)

With consent-based analytics: Can't compare 2022 data if consent expired
With Sealmetrics: Full 24-month view shows accelerating holiday growth

B2B SaaS Customer Lifecycle​

B2B companies with 12-18 month sales cycles need to track:

  • First touch → Lead → MQL → SQL → Customer (often 12+ months)
  • Free trial → Paid conversion tracking over extended periods
  • Feature adoption patterns across customer lifetime

Sealmetrics retains the entire journey without consent expiration destroying attribution data.

Content Marketing ROI​

Blog posts and content assets generate traffic for years. Long-term analytics show:

  • Which 2-year-old articles still drive conversions
  • SEO traffic growth patterns over 24 months
  • Content decay rates and refresh opportunities

This insight is impossible with consent-based analytics that delete data after 6-13 months.

Product-Led Growth Tracking​

SaaS products need to understand:

  • User activation patterns over first 12-18 months
  • Feature adoption timelines (what features users adopt after 6, 12, 18 months)
  • Cohort retention beyond consent expiration periods

With 24-month retention, Sealmetrics captures the complete product-led growth story.

Data Minimization Principle​

GDPR Article 5(1)(c) requires data minimization:

"Personal data shall be adequate, relevant and limited to what is necessary."

Sealmetrics achieves this by:

  1. Minimal collection: No IPs, no cookies, no persistent identifiers
  2. Aggregate data only: Session-based metrics, not individual profiles
  3. Automatic purge: 24-month deletion ensures data isn't kept indefinitely

Storage Limitation Principle​

GDPR Article 5(1)(e) requires storage limitation:

"Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary."

Sealmetrics complies because:

  1. Data cannot identify individuals: Session-IDs are temporary and non-linkable
  2. 24 months is proportionate: Reasonable for business analytics needs
  3. Automatic deletion: Built-in expiration prevents indefinite storage

The Assessment a DPO Will Actually Ask For​

Three questions:

Is any of it personal data?
Only briefly. The session identifier is pseudonymised data while its daily salt exists; it changes daily, cannot be linked across days, is never written to the device, and once rotated not even Sealmetrics can reconstruct it. The per-hit log is purged after one day. No IP is stored, hashed or otherwise. The 24-month reports are aggregated and non-identifying.

Is anything stored on or read from the user's device?
Nothing is stored on it. The tracker does read standard browser properties to compute the session identifier, which engages ePrivacy Article 5(3), the rule behind cookie banners; that read relies on the audience-measurement exemption (CNIL's criteria), not on consent.

So which Article 6 basis applies?
Legitimate interest, Article 6(1)(f), for the short-lived pseudonymised operational data. The balance is easy because the data is minimal and unrecoverable after one day.

CNIL's 2020 guidance confirms that cookieless audience measurement meeting its criteria can operate without consent.

Best Practices for Long-Term Analytics​

1. Leverage Full Historical Data​

Don't limit queries to recent months out of habit:

// Bad: Only checking last 3 months
const recentData = await getAnalytics({ months: 3 });

// Good: Using full 24-month history
const fullHistory = await getAnalytics({ months: 24 });
const yearOverYear = compareYears(fullHistory);

2. Build Year-Over-Year Dashboards​

Create dashboards that automatically compare:

  • This month vs. same month last year
  • This quarter vs. same quarter last year
  • Rolling 12-month trends

3. Track Cohort Behavior Long-Term​

Follow user cohorts through their entire lifecycle:

  • Users from Q1 2023: What happened after 12, 18, 24 months?
  • Traffic sources from 2023: Which generated best 2-year ROI?

4. Identify Long-Tail Content Value​

Find content that generates value long after publication:

  • Articles from 2022 still driving traffic in 2024
  • Evergreen content that compounds over years
  • Historical posts that become more valuable over time

5. Plan for Data Purge at 24 Months​

When data reaches 24 months:

  • Export critical insights before deletion
  • Document key trends and patterns
  • Update forecasting models with latest complete cycles

Frequently Asked Questions​

Is 24-month retention GDPR compliant?​

On our own assessment, yes. What Sealmetrics keeps for 24 months is aggregated, non-identifying reports; the per-hit log is purged after one day, and no IPs or cookies are stored. The 24 months come with automatic deletion — it's proportionate for business analytics and it keeps the retention question uncontroversial in a vendor review.

Why not unlimited retention like some competitors?​

While technically possible (the long-term data is aggregated), 24 months provides the optimal balance between analytical value and demonstrating GDPR compliance through reasonable storage limits. It covers two full years plus seasonal buffer, which satisfies 99% of business analytics needs.

What happens to data after 24 months?​

Data older than 24 months is automatically and permanently deleted from Sealmetrics systems. This cannot be reversed. Export any critical historical analysis before the 24-month mark if you need records beyond this period.

No, on our own assessment — though in Germany it is an open question (see Germany). Nothing is stored on the visitor's device, and the standard browser properties read to compute the session identifier rely on the audience-measurement exemption from ePrivacy Article 5(3) — the rule that mandates cookie banners — rather than on consent. Nothing stored identifies anyone, and the short-lived pseudonymised data relies on legitimate interest, not consent. You don't need cookie banners, consent management platforms, or consent tracking for Sealmetrics. Your privacy policy should mention Sealmetrics usage, but no active user consent is required.

Can I reduce retention to less than 24 months?​

Retention is fixed and identical for every plan — it is enforced by database TTLs and is not configurable. Since what is kept for 24 months is aggregated and non-identifying, there's typically no compliance reason to shorten it. If your organization needs data removed earlier, contact support to request deletion.

How does this compare to Google Analytics data retention?​

Google Analytics requires consent (cookie-based) and typically allows 14-26 month retention. However, when users withdraw consent or consent expires, Google Analytics must delete all associated data. Sealmetrics' 24-month retention doesn't depend on user actions because, on our own assessment, no consent is required.

Can I track individual users across 24 months?​

No. Sealmetrics uses session-based tracking, not persistent user tracking. Each visit generates a new Session-ID. This means you can see aggregate patterns over 24 months (traffic trends, popular pages, etc.) but cannot track individual users across sessions or time periods.

What if my business needs longer than 24 months?​

Export your data before it ages out: CSV exports from the dashboard, the API, or the BigQuery integration let you keep aggregated metrics for as long as your own policies allow, under your own control. Within Sealmetrics itself, 24 months covers seasonal analysis, year-over-year comparisons, and most B2B sales cycles.

Does Plausible or Matomo offer better retention?​

Plausible and Matomo offer longer retention options (unlimited in some configurations), but they store hashed IP addresses, creating higher personal data risk. Sealmetrics' zero-IP approach with 24-month retention provides the best balance of long-term analytics capability and privacy protection.

How do I access my 24-month historical data?​

All Sealmetrics dashboard views and API endpoints automatically include the full 24-month history. No special configuration needed. Simply set your date range in queries to span up to 24 months, and Sealmetrics will return the complete dataset.

Is data deleted exactly at 24 months or gradually?​

Data is purged on a rolling basis. When analytics data reaches exactly 24 months old (measured from the date of collection), it's automatically deleted. This means your oldest data is always approaching the 24-month mark, and you always have approximately 24 months of history available.

Can competitors see my historical data?​

No. Sealmetrics data is completely private to your account. Unlike some analytics platforms that aggregate data across customers, your 24-month historical data is isolated and accessible only to users with your account credentials.

Conclusion: The Strategic Advantage of Long-Term Analytics​

In a privacy-first world where consent-based analytics platforms lose historical data to consent expiration, Sealmetrics' 24-month retention provides a strategic competitive advantage.

Businesses using Sealmetrics can:

  • Make better decisions with complete historical context
  • Identify long-term trends that short-retention analytics miss
  • Calculate true ROI for marketing channels with long sales cycles
  • Optimize seasonally using multi-year comparison data
  • Track customer lifecycles beyond consent expiration limits

All while storing nothing on the device and no data that identifies anyone.

Unlike Google Analytics (which deletes data when consent expires), Plausible (which stores hashed IPs), or Matomo (which requires complex configuration), Sealmetrics provides the simplest path to long-term, privacy-first analytics.

Ready to gain 24 months of insight without a consent banner for your analytics?

Open your free account — your first 1M events are free, with no card — and experience analytics that doesn't depend on user consent.

Additional Resources​