GDPR and Analytics on WordPress: A Plain Guide

The GDPR is a data protection law, so what it asks about your analytics is narrow: are you collecting information that identifies a person, and if you are, on what basis, who else sees it, and how long do you keep it. It does not ban measuring your traffic, it names no plugin, and it is not the law that produces the cookie banner. Separate those two things and most of the confusion around analytics on a WordPress site disappears.

Here is what the rules actually cover, what your traffic data counts as, and how to put a site on a GDPR-friendly footing without pretending that a plugin can hand you compliance.

What the GDPR Actually Governs

The GDPR governs the processing of personal data, meaning any information relating to an identified or identifiable person. It applies if you are established in the EU, and also if you offer goods or services to people in the EU or monitor their behaviour there, which is how it reaches plenty of small sites run from elsewhere. The UK operates a near-identical regime of its own.

For a site owner, the law reduces to a short list of questions. What do you collect, why, on what lawful basis, who else can read it, where does it sit, and when does it get deleted. Those answers are about your data, not about your tooling. A well chosen plugin makes them easy to give; a badly chosen one makes them impossible.

The Cookie Banner Comes From a Different Rule

The consent prompt everyone associates with GDPR is not in the GDPR. It comes from the ePrivacy rules, implemented in the UK as PECR and through national law across the EU, and it fires on one specific act: storing information on a visitor’s device, or reading what is already there. Cookies are simply the most common way of doing that, and European regulators have said plainly that similar techniques, local storage and device fingerprinting included, are in scope too.

That is why the two rulebooks pull apart. A tool can store nothing at all on the device, which takes it out of the banner question, and still handle data the GDPR cares about, because every request carries an IP address whether you wanted it or not. The banner side has its own walkthrough in do I need a cookie banner just for analytics.

What Your Analytics Data Counts As

There are roughly three tiers here, and most arguments about reporting come from mixing them up.

Aggregate counts sit at the safe end. Say a post got 1,240 views yesterday and a third of them came from search: there is no person in that number to identify.

Online identifiers sit at the other end. A cookie ID, a device fingerprint, a hashed visitor ID that stays stable for weeks: a stable identifier is personal data even with no name attached, because singling someone out is the entire job it does.

The IP address sits between them, and this is the part site owners miss. In the EU it is generally treated as personal data, cookie or not, because it can be combined with other information to identify the person behind it. So “we set no cookies” is a complete answer to the banner question and only a partial answer to the data protection one. What matters next is whether your tool keeps the address at all, and for how long.

Where the Data Goes After It Leaves Your Site

A third-party analytics script does not only measure your visitors, it introduces them to somebody else. The visitor’s browser connects directly to the vendor’s domain, handing over their IP address and the page they are reading before any setting of yours applies.

Three questions settle most of this. Who receives the data, in which country is it stored, and will the vendor sign a data processing agreement that names their sub-processors. Vendors who designed for those questions make the answers easy to find. Vendors who make you dig usually have a longer chain than you expected.

The Part That Is Specific to WordPress

Analytics is one row in a much longer table. A normal WordPress install has a contact form storing an IP address with every entry, a spam filter shipping comment data to a third party, embeds from a video host, a backup plugin copying the database somewhere else, and often an avatar service receiving a hash of each commenter’s email address.

Two practical moves follow. First, write a one-page inventory: each plugin, what personal data it touches, and where that data goes. It takes an afternoon, and it is the document you will want the first time somebody asks. Second, delete what you do not use. An unused plugin still collects, and for most sites the fastest privacy improvement available is removing three things nobody needed.

Building a GDPR-Friendly Analytics Setup

The design that leaves you least to explain is cookieless and first-party. Cookieless means no analytics cookie and no identifier stored on the device, so the banner question never starts. First-party means collection goes to your own domain instead of out to a third-party host, so your visitors are not introduced to anyone new.

DevDome Analytics works that way by default rather than as a checkbox you have to remember. The reporting survives the trade: country, region and city, a live visitor view, clicks captured server-side so an ad blocker cannot delete them, and six signals separating real people from bots, with plans metered on human pageviews only. That same server-side approach is what lets you count something like scans of a printed QR code through a short link without touching the scanner’s phone. If you want the field rather than one product, we compared six privacy-friendly analytics alternatives for WordPress, and our plans start at free. The mechanics of counting people without identifying them are in cookieless analytics explained.

What No Plugin Can Do for You

This is not legal advice, and no tool can promise you compliance, ours included. Software decides what gets collected and where it goes. It cannot write your privacy policy, answer a visitor’s request about their data, choose your retention period, or know which regulator is yours.

So do the parts only you can do. List what you collect, describe it in plain words on your privacy page, keep nothing longer than you need it, and read your own regulator’s guidance rather than somebody’s summary of it. Then pick tooling that keeps the list short. A cookieless, first-party setup is not a legal shield, but it does mean the honest answer to “what do you collect about visitors” fits in a paragraph.