GDPR-compliant tracking is any form of website analytics where visitor data is only collected when and in a way that the data protection rules allow, which in practice usually means only after the visitor has given consent. The key lever is not the tool you use, but the moment at which collection starts.
In this article we explain in plain words what separates consent-based from consent-free tracking, how cookie banners, cookieless analytics and server-side tracking work, and what you need to watch out for as a small or mid-sized business.
What does "tracking" actually mean?
Tracking means your website records who comes, what they look at and what they do, such as clicks, form submissions or time on page. Technically, this usually works through scripts from tools like Google Analytics or Meta, which activate when the page loads and send data to their servers.
A simple picture: tracking is like a visitor book at the entrance of your building, useful, but only acceptable if people know what gets written down and why.
Why does tracking get tricky under the GDPR?
The reason is simple: even a single IP address counts as personal data. Once data goes to a third-party tool, data transfer abroad comes into play, a known stumbling block for US-based tools. Since the EU-US Data Privacy Framework (the European Commission's 2023 adequacy decision), transfers to certified providers are possible, but they still need to be checked and documented case by case.
On top of that, the consent principle applies: the tool may only start once the visitor has actively agreed. In Germany, section 25 TDDDG requires consent for storing or reading information on a visitor's device unless it is strictly necessary. "Continuing to browse" or pre-ticked boxes do not count.
What is a cookie banner and what does it have to do?
A cookie banner is the box that appears when the page loads, asking the visitor for consent. Legally, it is the means by which that consent is obtained. The points that matter:
- Two equal buttons: "Accept" and "Reject" must be equally easy to reach.
- Grouping: necessary, functional, analytics and marketing cookies are explained separately.
- Traceability: you must be able to show what the visitor chose, and when.
- Revocability: the choice can be changed at any time, not just once.
What is cookieless analytics?
Cookieless analytics avoids cookies as the storage mechanism. Instead, visits are grouped using other, often shorter-lived identifiers, such as an anonymised session or a locally stored key that does not persist in the browser indefinitely. Note that a locally stored identifier still requires consent unless it is strictly necessary.
The upside: less data tied to a person over time. The downside: reach measurement becomes less accurate, and tracking returning visitors is more limited.
What is server-side tracking?
With server-side tracking, the script does not run in the visitor's browser but on your own server. Your server queries the analytics tool instead of the browser reaching out to it directly.
That brings two advantages:
- Less data leaves the browser, because not every script talks to the tool directly.
- You have more control over which data is sent to the tool in the first place.
But: server-side tracking is not a free pass. If data ultimately ends up in the US or a visitor's device is read, you still need a legal basis.
What should SMEs specifically watch out for?
For SMEs the rule is: not the most expensive solution, but the cleanest one. These points are the fastest route to a setup that holds up:
- Take stock: which tracking tools are active on your site? (analytics, Meta, YouTube, Maps, retargeting…)
- Clarify the legal basis: consent, legitimate interest, or an exemption?
- Check the cookie banner: is rejection as easy as acceptance?
- Document the data flow: which data goes to which server?
- Data processing agreement (DPA) signed with every tool provider
- Test after every update: after any technical change, verify that consent still works
Conclusion: it is about the moment of collection, not the tool
GDPR-compliant tracking is not a single tool but a principle: ask first, measure second. Anyone who tells their visitors what happens and gives them a real choice will usually stand up well to a review. The fastest lever for SMEs is the inventory, because until you know what is actually running, you cannot configure anything properly.
And if you are not sure whether your current setup holds: talk it through with us: we will look at your tools, your banner and your data flow together.
For more foundations, see our article ChatGPT and GDPR: what businesses need to know and our digital marketing offering.
