GDPR-compliant web analytics

The GDPR governs the processing of personal data — any information relating to an identified or identifiable person (Article 4). The consent obligation that puts a banner on so many sites actually comes from the ePrivacy Directive, which requires opt-in before storing or reading information on a user’s device, such as a cookie.

Pulse is built to sit outside both triggers. It sets no cookies and stores nothing identifying on the device — the current tab’s sessionStorage holds only a five-second guard against double-counting a refresh, never an identifier — so the ePrivacy consent requirement does not apply. And it collects no personal data: IP addresses are used only to resolve a country at request time and are then discarded, visit and visitor keys are server-derived hashes that rotate daily and monthly, and no visitor can be singled out or tracked across sites. With no personal data and no identifying device access, there is no lawful-basis question to answer and no consent to collect.

This is a different posture from “GDPR-ready”. You are not relying on a correctly-configured consent tool, a data-processing addendum and a region setting to stay compliant — the data that would create the obligation is simply never gathered.

Data minimisation is a GDPR principle, not just a nicety: you should collect only what you need. Pulse takes that literally. No name, no email, no account, no cross-site identity, and no identifier that outlives a calendar month — so there is nothing in a breach that could identify a visitor, and a data-subject request about one cannot be answered because the data has never been linkable to a person in the first place. Visitor-level views group a month’s pageviews under a pseudonym that is re-minted every month; they are off by default and switched on per site by its owner.

Jurisdiction matters too. Pulse is operated by Ciphera BV, a Belgian company, with data held on Swiss and EU infrastructure. Your analytics provider is inside the EU and subject to EU law, rather than a foreign company whose home jurisdiction can reach into the data. And because the dashboard and tracking client are open source, your data protection officer can verify what is collected instead of trusting a marketing claim.