GDPR-compliant analytics means measuring your website's traffic and revenue in a way that respects the EU's data protection rules: a clear purpose, minimal personal data, no tracking that needs consent unless you have it, and safe handling of any data that leaves the EU. No tool is compliant on its own. The tool is one half. How you configure it and what else runs on your site is the other half. If you sell to people in the EU from the US, the rules can apply to you too.
This guide explains when the GDPR reaches a US business, when consent is needed, what "cookieless" and "consentless" really mean, and how to evaluate a tool without losing sight of revenue and campaign results.
What GDPR-compliant analytics actually means
The General Data Protection Regulation is technology-neutral. According to the European Commission, it covers automated processing of personal data, and "processing" includes collecting, storing and consulting data. A page view log, a device identifier or a recorded IP address can all fall inside that definition if they relate to an identifiable person.
So "GDPR-compliant analytics" is shorthand for a few things happening together:
- You have a lawful reason to measure, and you can state the purpose (for example, understanding which pages and campaigns lead to purchases).
- You collect only what you need. Aggregate counts and revenue totals need far less than a person-level history.
- You respect the consent rules that apply to anything stored on or read from a visitor's device.
- You control where data goes, including vendors that process it for you and any transfer outside the EU.
- You can show your work: a record of what you collect, why, and for how long.
The controller and processor each have responsibilities. Document roles and processing terms, access controls, retention and deletion, rights handling and incident procedures as applicable. A vendor can support these tasks; neither its badge nor your paperwork alone establishes compliance.
Does the GDPR apply to a US business?
For a business outside the EU, assess territorial scope for the particular processing activity. Relevant factors include an EU establishment, offering goods or services to people in the EU, and monitoring behaviour there. A visitor's nationality or a website being accessible from Europe does not by itself settle the question.
The European Commission explains the scope of the GDPR. Assess targeting and monitoring in context, including what the organisation actually does with website data. A checklist can flag a need for review, but cannot replace that assessment.
In practice, ask yourself:
- Do you ship to EU countries, price in euros, or translate your store for EU markets?
- Do you run ads or SEO campaigns aimed at EU audiences?
- Do you have EU customers who sign up or check out on your site?
A positive answer is a reason to investigate scope, not a conclusive legal test. Document the facts for the processing activity and obtain advice where the position is uncertain. Separately assess local and sector-specific privacy requirements.
What about "GDPR in the USA"?
US federal, state and sector-specific privacy requirements are distinct from the GDPR. A GDPR assessment does not establish compliance with every US obligation. Identify the laws applicable to the business, data and activity rather than treating "privacy-first" as a universal legal status.
When analytics needs consent, and when it might not
CNIL's French audience-measurement guidance describes a narrow exemption with strict purpose, separation and statistical-output conditions. It is not blanket permission for purchase matching, advertising attribution or cross-site tracking. Obtain evidence for the exact configuration and jurisdiction instead of extending a basic audience-measurement assessment to every feature.
People often assume the GDPR itself demands a cookie banner. The more direct source of the banner is the ePrivacy Directive. Its Article 5(3) allows storing information on a user's device, or accessing information already stored there, only with the user's consent, unless it is needed to transmit a communication or is strictly necessary to provide a service the user asked for. The European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3) set out how that rule applies to modern tracking techniques, not just classic cookies.
Do not decide consent requirements from the word "cookieless". The technical scope includes more than cookies, and the actual storage, access, identifiers and processing matter. National implementation and any applicable exemption must be assessed alongside a GDPR lawful basis for personal-data processing.
Two cautions keep this honest:
- "Cookieless" is a claim about storage, not about law. Fingerprinting, persistent identifiers and other techniques can also fall under the Article 5(3) analysis. Read how a vendor identifies visitors, not just whether it sets cookies.
- National regulators and courts differ in how they read these rules. If your business is large, regulated or sells heavily into one EU country, get advice from a privacy professional in that jurisdiction before dropping a consent banner.
Cookieless, compliant and consent-enforcing are three different things
Compare three separate questions: how measurement works, whether the processing is lawful in context, and how choices are enforced. A vendor's marketing label is not evidence that all three have been addressed.
Audit every relevant data path, including tag managers, embeds, browser storage, app SDKs and backend forwarding. A cookie-free analytics setting does not govern an unrelated ad pixel or prove that sensitive data is excluded from URLs and event fields.
A practical setup checklist
Use this as a working list when you configure analytics on a site with EU visitors. It reflects common privacy-by-design practice, so confirm the legal details for your situation with a specialist.
- Inventory every script. Open your site's tag manager and your page source. List each tool that loads, what it collects and where it sends it.
- Define your purpose in one sentence. For example: "measure which pages and campaigns lead to orders." If a data point does not serve that sentence, do not collect it.
- Prefer aggregate data. Revenue by page, channel and keyword answers most marketing questions without individual profiles.
- Assess device access and storage. Obtain consent where required and document any exemption relied on. Do not assume every first-party or cookie-free technique is exempt.
- Check the vendor's data processing terms and where data is hosted. Note any transfer outside the EU and the mechanism relied on.
- Set a retention period and write it down.
- Update your privacy notice so it describes the analytics you actually run.
- Keep a dated record of the above, and a named person who reviews it.
What about Google Analytics?
No bundle of GA4 settings guarantees lawful use. Assess collection, purposes, roles, contract terms, retention and international transfers for the actual deployment. Consent Mode communicates choices to tags; it is not itself a consent banner or legal determination. Server-side routing and a claimed EU hosting location do not settle these questions.
Google distinguishes basic and advanced Consent Mode. Basic blocks Google tags until consent; advanced can send cookieless pings when consent is denied and support modelled reporting. Observed, modelled and missing data are different. Assess whether the actual transmissions are permitted; do not use modelling or another tool to bypass a refusal.
Choosing a tool: the criteria that matter
Most "best GDPR-compliant analytics" lists rank tools on privacy alone. If you run an online store or a marketing team, privacy is necessary but not enough. Use these criteria.
Does it measure money, not just visits?
Pageviews and bounce rates do not pay invoices. Look for revenue attribution by channel, page and, ideally, keyword, tied to your payment platform. If a tool can show revenue without exposing who each buyer is, you get the ROI answer and a smaller privacy footprint. This links directly to what analytics is for; analytics-driven marketing and ROI is worth understanding before you compare dashboards.
How does it identify visitors?
Ask how visitors are counted, what device information is accessed, what identifiers are generated and how long they last. Include server-side processing and cross-session matching. Short-lived or hashed identifiers can still involve personal data; they do not automatically establish anonymisation or an exemption.
Where does the data go?
Check hosting location, subprocessors and the transfer mechanism. Put those details in your records.
How much setup does it need?
Map every integration even if installation uses one snippet. A smaller stack can simplify administration, but collection scope, recipient access and vendor concentration still need review.
Can you act on what it shows?
A compliant dashboard that nobody reads helps no one. Look for alerts, reports sent by email and plain-language findings, so you spend your time fixing problems rather than interpreting charts.
What does it cost as you grow?
Many tools price by pageviews or sites tracked. Work out your expected traffic for the next year and check how overages are charged.
Our perspective on privacy-first analytics
We built Cromojo on a simple belief: most businesses do not need to know everything about each visitor. They need to know which pages, channels and keywords make money, and where visitors drop out before they buy.
Cromojo offers cookie-free and returning-visitor tracking modes with different device-storage behaviour. Eligible Stripe or Shopify purchases can be matched to recorded activity through a supported checkout reference. That payment link needs its own purpose and privacy assessment; aggregate dashboard output does not mean no personal data was processed upstream.
Configured monitoring can surface issues, with coverage and timing depending on enabled checks and available data. URL submission workflows use configured integrations and eligibility rules; submission is not guaranteed indexing or AI-search inclusion. These features do not change the legal assessment of analytics.
Compliance is a shared job, and no tool can promise it for you. Our aim is to make the privacy-respecting path the easy one: collect less, measure what matters, and keep the setup small enough to audit.
Revenue measurement without the data sprawl
A small-store stack may contain analytics, advertising, email, replay and third-party widgets. Record each purpose, recipient and data flow. Consolidation can reduce administrative work but does not automatically reduce risk or make all purposes compatible.
For a Shopify store, page and campaign attribution can help investigate content associated with eligible matched purchases. Organic keyword revenue is estimated from Search Console, not an exact query-to-buyer record. Review the matching data and permissions before enabling revenue attribution, even if the final report is aggregated.
Agencies should assess each client separately: roles, access permissions, notices, retention and contracts can differ. One dashboard does not establish one lawful basis or a single compliance decision for every client.
Keeping your compliance current
Rules and regulator guidance move. The EDPB guidelines cited above were adopted in their final form in October 2024, a reminder that interpretations of tracking rules are still being refined. Build a light routine rather than a one-off project:
- Review twice a year. Re-run your script inventory and compare it with your privacy notice.
- Log changes. When you add a pixel, a plugin or a new vendor, note the date, purpose and data collected.
- Watch official sources. Follow your data protection authority of choice and the EDPB's published guidance rather than blog summaries.
- Re-check vendors. Confirm hosting location, subprocessors and terms when they update them.
- Escalate when risk changes. If you start targeting a new EU country, add sensitive product categories or begin collecting more data, speak to a privacy professional first.
How Cromojo fits
Cromojo revenue analytics connects eligible Stripe or Shopify purchases with recorded activity for page, source and campaign reporting, with estimated organic keyword revenue. Matching and coverage depend on tracking and checkout setup. Review cookie-free versus returning-visitor settings, payment-data use and applicable choices before deployment.
Compare current feature, site and traffic allowances on the pricing page. Billing terms and overage availability vary by plan. Product access and a small subscription price do not establish that a deployment meets privacy requirements.
If your main question is which marketing efforts bring in orders, start with revenue analytics. If you want live visibility, see real-time analytics, and for uptime and SEO checks, look at website monitoring.
