GDPR-compliant analytics for EU businesses: what actually matters

European businesses face two rulebooks. The ePrivacy Directive (implemented nationally, e.g. PECR in the UK, TTDSG/TDDDG in Germany) requires consent before storing or reading information on a device unless it's strictly necessary — which is why cookie-based analytics usually needs a banner. GDPR then governs any processing of personal data, including IP addresses, wherever it happens.

VisitTrack is designed around both. In cookieless mode nothing is stored on the device: the visitor id is a server-side hash of site, IP and user agent with a salt that rotates daily, and the IP is never stored. Data lives in VisitTrack's databases on EU infrastructure, a DPA is available at /dpa, and personal data you add yourself (identify traits) can be deleted per person. This page is general information, not legal advice.

What EU businesses should check in any analytics tool

1. 1.Does it store or read anything on the device?

   That's the ePrivacy question. Cookies, localStorage and fingerprinting all count. VisitTrack's cookieless mode writes nothing — no cookie, no localStorage, no sessionStorage.

2. 2.What personal data is stored, and for how long?

   IP addresses, user ids and traits are personal data. VisitTrack never stores IPs; identify traits are only stored if you send them, are never shown on public dashboards, and can be deleted per person.

3. 3.Where is the data processed?

   VisitTrack stores analytics data in its own databases on EU infrastructure. The IP-to-location lookup is the one step that uses a geolocation provider.

4. 4.Is there a DPA and a sub-processor list?

   Under GDPR Article 28 you need a data processing agreement with your analytics processor. VisitTrack publishes one at /dpa; see also /gdpr.

5. 5.What do you lose without a stored identifier?

   In cookieless mode, returning visitors after 24 hours count as new, and multi-day journeys and attribution are limited — unless your app sends the first touch back at signup. Know the trade-off before choosing.

Questions EU businesses ask about analytics

Can we remove the cookie banner?

For analytics, cookieless mode is designed to run without consent under ePrivacy, because nothing is stored or read on the device. Any other cookies you set (ads, chat widgets, embeds) still need their own assessment.

Is Google Analytics legal in the EU?

Several EU data-protection authorities (Austria, France, Italy) ruled in 2022 that specific Google Analytics setups breached GDPR transfer rules. The EU–US Data Privacy Framework adopted in July 2023 changed the transfer picture for certified US companies, but GA4 still uses cookies and generally needs consent. Check current guidance with your counsel.

What about visitors outside the EU?

Hybrid mode applies cookieless tracking to visitors in the EU/EEA, UK and Switzerland (and anyone whose location can't be determined), and standard tracking for everyone else.

How do we handle a deletion request?

Delete the person from the People tab or via the API with a write key; their user id and traits are removed from every visitor record and the deletion is logged in Settings → Activity.

How to set up GDPR-friendly analytics with VisitTrack

1. 1

   Choose a tracking mode

   Settings → General → Tracking mode: cookieless (nothing stored anywhere), hybrid (cookieless in the EU/EEA, UK and Switzerland) or standard (a first-party _vt_vid cookie — generally needs consent in the EU). The server enforces the site-wide mode for every script tag. See cookieless mode.

   <script defer data-site="SITE_ID" data-cookieless src="https://visitrack.app/tracker.js"></script>

2. 2

   If you choose hybrid, add the attribute

   data-hybrid makes the script store nothing until the server has checked the visitor's country.

   <script defer data-site="SITE_ID" data-hybrid src="https://visitrack.app/tracker.js"></script>

3. 3

   Keep attribution across days without cookies

   Add a hidden data-vt-first-touch field to signup forms, or read window.visitrack.attribution(), and send the first touch back at signup. Payments are then credited to the original source even though nothing was stored on the device.

4. 4

   Sign the DPA and update your privacy notice

   Review the DPA, list VisitTrack as a processor in your privacy policy, and describe what's collected (paths, referrers, UTMs, approximate location, device type — see /gdpr).

5. 5

   Be deliberate with personal data

   Only send identify traits you need, mask personal text if you enable session replays (form fields are always masked), and keep replays' 30-day automatic deletion in mind for your records of processing.

Example: switching a German online shop from GA4 to cookieless analytics

A shop that showed a consent banner; roughly half of visitors declined analytics cookies.

Illustrative numbers for a typical site of this kind, not real customer data.

The shop sees roughly twice as many visitors — not because traffic grew, but because declined-consent visitors were invisible before. The trade-off is weaker multi-day visitor history, which the first-touch handoff at checkout recovers for the decisions that matter.

VisitTrack vs GA4, Matomo and Plausible for EU compliance

Third-party details as of October 2026; this is not legal advice.

If you need full data sovereignty on your own servers, self-hosted Matomo is the established choice. If you want hosted, cookieless analytics with revenue attribution, VisitTrack fits. See VisitTrack vs Matomo, vs Plausible and the cookie banner checker.

What VisitTrack costs for an EU business

Cookieless mode often reveals more traffic than consent-gated tools reported — budget from your server logs or a week of cookieless data.

Every feature is on every plan; the price only follows monthly events (pageviews, custom events and payments, counted across all your sites). Bot and AI-crawler hits and session replays are never billed. Yearly billing is ten months' price for twelve, every plan starts with a 14-day free trial with no card, and there's a one-time lifetime deal from $59.