GDPR is the global benchmark for privacy regulation. While it's an EU law, it affects every company with EU visitors. For analytics, GDPR is clear: you need explicit consent before tracking most user behavior, you must document your legal basis, and you must honor user rights to access and delete their data. Understanding GDPR is the foundation for building compliant analytics worldwide.
GDPR's Core Requirements for Analytics
GDPR defines personal data broadly: anything that can identify a person, directly or indirectly. An IP address is personal data. A unique cookie is personal data. Email addresses, phone numbers, and identifiers all fall under GDPR. For analytics, this means almost all tracking triggers GDPR requirements.
The Consent Requirement
GDPR requires explicit, informed consent before you can collect most personal data. This means: the user must actively agree (not just fail to opt out), they must understand what they're agreeing to (not hidden in legalese), and consent must be freely given (not coerced). For analytics, this typically means a cookie banner that clearly explains what tracking you're doing and gets an active "I agree" click.
Consent is the most common legal basis for analytics under GDPR. Some companies claim a "legitimate interest" basis instead, but courts have narrowed this significantly. For most analytics use cases, assume you need consent.
Legitimate Interest as an Alternative
Some analytics purposes—fraud detection, site security, basic performance monitoring—may be allowed under "legitimate interest" without explicit consent. But legitimate interest requires: the business need must be genuine, the data collection must be proportional to that need, and users' privacy rights must not outweigh your interest. Most analytics fails this test. Assume you need consent for most tracking.
The Data Processing Agreement
If you use a third-party analytics tool (such as Google Analytics), you need a Data Processing Agreement (DPA) with that vendor. The DPA establishes that the vendor is your data processor, not an independent controller. Without a DPA, you can be liable for the vendor's practices. With one, responsibility is clearly defined.
User Rights Under GDPR
GDPR gives individuals six main rights that affect analytics: the right to know what data you hold (right of access), the right to correct inaccurate data, the right to delete data (right to be forgotten), the right to limit processing, the right to data portability, and the right to object to processing.
Right of Access
Users can request all data you hold about them. You must respond within 30 days with a complete record. For analytics, this means you need systems to retrieve and report on individual user data. If your analytics is stored in a way that's difficult to retrieve, you have a GDPR compliance problem.
Right to Be Forgotten
Users can request deletion of their data. You must comply within 30 days (with some exceptions for legal obligations). For analytics, this means you need the ability to delete individual user records. If your analytics data is aggregated or anonymized, this is easier. If it's tied to individual identities, you need deletion systems in place.
Right to Object
Users can object to any processing of their data. You must stop (unless you have a compelling legal reason to continue). For analytics, this means you need an easy way for users to opt out of tracking. The opt-out must be as easy to use as the opt-in.
GDPR Compliance in Practice
GDPR compliance for analytics requires: a clear, easy-to-find privacy policy; a cookie banner asking for explicit consent before tracking; a Data Processing Agreement with your analytics vendor; systems to respond to user access and deletion requests within 30 days; and the ability for users to withdraw consent at any time.
Common GDPR Violations in Analytics
Pre-ticked consent boxes: The user must actively click to consent. A box that's already checked is not valid consent.
Bundled consent: Users must consent separately to analytics. You cannot combine consent for analytics, marketing, and other purposes into a single toggle.
No vendor agreements: Using a third-party analytics tool without a DPA is a violation. The vendor's practices are your responsibility.
No opt-out: If consent is required for tracking, users must have a clear way to opt out. Hidden opt-out links do not count.
Impossible deletion: Promising to delete data but lacking systems to do so is a violation. Deletion must be technically possible.
GDPR and Data Transfers
GDPR restricts transferring EU resident data outside the EU unless equivalent protections are in place. If your analytics vendor stores data in the US, you need a legal mechanism (Standard Contractual Clauses, Binding Corporate Rules) to make the transfer GDPR-compliant. This is a common pain point for analytics teams. Many US-based tools now offer EU servers or data residency guarantees to solve this.
How is GDPR consent different from legitimate interest? Why not rely on legitimate interest for analytics?
Consent is explicit opt-in. Legitimate interest is claiming your business needs outweigh privacy concerns. Courts have narrowed legitimate interest because companies abused it. For analytics: page view tracking for performance might qualify as legitimate interest. Detailed behavioral tracking probably doesn't. EU regulators say: if it's for marketing or behavioral analytics, get consent. Don't assume legitimate interest works. Safe approach: treat analytics as requiring consent.
What does clear explanation in a cookie banner actually mean?
Clear means readable plain language, not legalese. Specific means you say what you're tracking, not vague phrases like "enhance your experience." Example of vague: "We use analytics cookies." Example of clear: "We use Google Analytics to measure page visits, button clicks, and time on page to improve the site." Include: tool name, what it collects, why you're collecting it, retention period, and whether you share it with third parties. Test: could a non-technical person understand what you're tracking without clicking to your privacy policy? If yes, it's clear enough.
Do I need a DPA with Google Analytics, or only with specialized vendors?
You need a DPA with any tool processing personal data. Google Analytics processes personal data (IPs, sessions, user IDs), so yes. Google provides a DPA automatically via their terms. Verify: log into Google Analytics and confirm you've accepted their Data Processing Amendment. Specialized analytics vendors also process personal data, so you need DPAs with them. Most provide DPAs in their terms or as separate documents. Rule: if vendor touches personal data, you need a DPA. If you can't get one, don't use the vendor.
What's the difference between Standard Contractual Clauses and adequacy decisions?
Both are mechanisms to legally transfer EU data outside the EU. Adequacy decision means EU determined a country has equivalent privacy protection (US doesn't have one). Standard Contractual Clauses (SCCs) are contracts with vendors committing them to EU standards. Practical difference: adequacy decisions simpler, SCCs require contracts. For analytics, most vendors (including Google) offer SCCs in their DPAs. Verify with your vendor: do they offer Standard Contractual Clauses for EU data transfers? If yes, use those. If no, only use vendors with EU data storage.
If I get a data access request, what exactly must I provide from analytics?
Everything you have about that person in readable format. From Google Analytics: all sessions and events (if you track user IDs) or session IDs. Include: dates, pages visited, events triggered, time on page, any PII (names, emails). From other systems: heatmaps, session recordings, behavioral tracking. Export as PDF or HTML, not raw database dumps. User should understand it without technical knowledge. If you can't retrieve individual user data easily, you have a GDPR problem. Most platforms allow per-user export. If yours doesn't, switch platforms or build custom export.
My competitor doesn't have a cookie banner and tracks users. How are they GDPR-compliant?
They're either: (1) Not actually GDPR-compliant and hoping regulators don't catch them (risky). (2) Arguing their tracking is legitimate interest (courts skeptical). (3) Tracking only anonymized/aggregated data (no consent needed). (4) Tracking only essential cookies (login, CSRF—no consent needed). (5) Operating where GDPR enforcement is weak. Reality: many violate GDPR and never get caught. But risk is real: one complaint triggers investigation and fines. Smart approach: assume GDPR applies if you have EU visitors, implement consent properly, don't count on competitors' noncompliance.