Digital Analytics
Digital analytics—measuring website and app performance—is foundational to business operations but faces ongoing regulatory challenges. Compliant analytics requires careful tool selection, configuration, and consent management.
By Sergio Maldonado Elvira, Attorney, State Bar of California · FIP, CIPP/US, CIPP/E, CIPT
Published · Last reviewed
Key points
- →Configure analytics for GDPR compliance
- →Evaluate privacy-friendly alternatives
- →Manage consent for tracking cookies
- →Navigate data transfer requirements
Google Analytics compliance challenges
Google Analytics has faced regulatory action across Europe due to US data transfers. Following Schrems II, several EU DPAs found GA4 implementations non-compliant. While Privacy Shield 2.0 (EU-US Data Privacy Framework) provides a new legal mechanism, its durability is uncertain. Evaluate whether GA-specific legal risks are acceptable for your organization.
Privacy-friendly analytics alternatives
Alternatives to traditional analytics include: first-party analytics (Plausible, Fathom, Matomo) that don't share data with third parties, aggregate measurement solutions that minimize personal data, server-side log analysis avoiding client-side tracking, and privacy-preserving measurement APIs (Attribution Reporting API). Evaluate tradeoffs between data richness and privacy risk.
Consent implementation for analytics
Under GDPR, analytics cookies generally require consent—they're not strictly necessary for website functionality. Implement proper consent flows: block analytics scripts until consent obtained, respect withdrawal by stopping data collection, maintain consent records, and audit consent rates to understand data coverage. Cookie-less analytics approaches may reduce consent friction.
Cross-border data transfer compliance
Analytics data sent to US-based providers raises transfer mechanism questions. Options include: relying on EU-US Data Privacy Framework certification, implementing Standard Contractual Clauses with transfer impact assessments, using EU-based analytics providers, or configuring existing tools to store data regionally. Document your legal basis for any cross-border transfers.
Related reading
This guide is general information, not legal advice. Reading it does not create an attorney-client relationship. The law is stated as of January 28, 2026.
Got questions?
Every business is different. Let's discuss how these principles apply to your specific situation.
Book a call