GDPR analytics, hosted in the EU
No analytics tool is "GDPR compliant" on its own, because compliance is a property of processing, not of software. What you can do is pick a tool that does not create problems to solve. This page explains what those problems are and which of them disappear when measurement never touches the device and never leaves the EU.
Free plan with no time limit. No card. Setup takes a minute.
Two different laws, two different duties
The commonest misunderstanding is treating this as one question. It is two, decided independently, and answering the first well does not release you from the second.
The first comes from the ePrivacy Directive, Article 5(3), as implemented in each member state. It concerns storing information on, or gaining access to information stored on, terminal equipment. The consent duty arises from the act of storing, whether or not the stored value is personal data. That is why it is called a cookie banner and not a GDPR banner.
The second comes from the GDPR and concerns processing personal data: you need a legal basis, a privacy notice, a processing agreement with your vendor, a record of processing activities and an answer to data subject requests. That question remains even when nothing is written to the device, because a visitor IP address is personal data before you truncate it.
The conditions under which measurement needs no consent
European data protection authorities allow traffic measurement without consent where it meets specific conditions. The French CNIL described them in the most detail, and in practice its list is the reference point across the Union.
- measurement serves only to measure traffic on that one site, not advertising or profiling
- the data goes only to the site publisher and is not combined with anything else
- the output is statistics, not records about identified people
- any identifier on the device lives at most thirteen months and is not extended on a new visit
- the collected data is kept for at most twenty five months
- both periods are reviewed periodically and limited to what is strictly necessary
The first three conditions describe what the tool is for at all. The fourth concerns an identifier on the device, and with us it is met in a way that cannot be broken: we store nothing, so there is nothing to extend. The fifth is the reason our retention is exactly twenty five months rather than "as long as we can".
Why the location of the server still matters
Transferring data to the United States is lawful today where the recipient is certified under the EU-US Data Privacy Framework. The Commission 2023 adequacy decision stands, and in September 2025 the General Court of the European Union dismissed the first challenge to it in the Latombe case. So it is not true that transfers are illegal, and we are not going to write that.
The real argument is different and it is enough. That judgment was appealed to the Court of Justice in October 2025 and the appeal is still pending. The Court of Justice is the same body that annulled the two previous mechanisms: Safe Harbour in 2015 and Privacy Shield in 2020. This is the third attempt to settle the same question in ten years, and each annulment meant a sudden change of legal basis for processing that was already under way.
What metuno does, concretely
Desplaza la tabla en horizontal para ver las demás columnas.
| Question | Answer |
|---|---|
| Written to the device | Nothing: no cookies, no localStorage, nothing else |
| ePrivacy consent duty | Does not arise, there is no storage or access |
| IP address | Truncated to a network before use, never written down |
| Recognising a visitor | A pseudonym valid for one UTC day, then unreconstructable |
| Cross site tracking | Impossible: the site id goes into the hash |
| Where the servers are | Warsaw, European Union |
| Transfers outside the EU | None for measurement data |
| Event retention | 25 months, then deleted automatically |
| Data processing agreement | Ready, to download and sign |
| Sub-processors | Named in the processing agreement |
What this page will not do for you
Choosing a tool settles one part of the matter, not all of it. If your site runs an embedded video, an advertising pixel, a chat widget or a map, a consent banner will still be needed because of those, not because of us. Compliance is assessed for a site, not for one script on it.
You also keep the duty to inform: a mention in your privacy policy that you measure traffic, what you measure it with and on what basis. That is one paragraph, but it has to exist, and no tool will write it for you in a way that describes your particular site.
Questions that come up most often
- Am I really free of the consent banner?
- For the measurement itself, yes, because the Article 5(3) duty concerns storing and reading on the device and our script does neither. If anything else on your site writes to the device, a banner will be needed because of those things. We are not your lawyer and the final assessment is yours.
- Is an IP address not personal data?
- It is, which is why we do not keep it. We truncate it to a network before it enters the pseudonym calculation: IPv4 loses its last octet, IPv6 is cut to /48. The full address exists in server memory for the duration of one request, and the database schema has no column it could land in.
- I need a data processing agreement. Do you have one ready?
- Yes, it is on the site to download and you do not have to ask for it. It names every sub-processor, the scope of data each one receives and where processing happens. Legal teams usually ask about that and the sub-processor list first.
- What do I answer to an erasure request?
- In practice: that there is nothing to erase. A visitor pseudonym expires after one day, and beyond that the data of a particular person cannot be located, because the material needed to link it no longer exists. That is an answer you can give in writing, and it follows from the design rather than from our goodwill.
- How is this different from Google Analytics with IP anonymisation?
- Anonymising the address addresses one of the two questions and leaves the other untouched: Google Analytics still writes an identifier to the device, so the ePrivacy consent duty remains. On top of that sits the transfer question, which does not arise with servers in the EU. A separate comparison goes through this row by row.
Measure traffic without adding paperwork
One line in your page, data in Warsaw and a processing agreement ready to sign. The free plan covers one site and has no traffic ceiling.
Fuentes
- Sheet no. 16: use analytics on your websites and applications, CNIL, 2025
- European General Court dismisses Latombe challenge, upholds the EU-US Data Privacy Framework, IAPP, 2025
- Directive 2002/58/EC on privacy and electronic communications, Article 5(3), EUR-Lex, 2009
This describes our implementation and the rules we rely on, and is not legal advice. You must assess compliance for your own site yourself, preferably with a lawyer, and it depends on what else runs on that site. The legal position was checked on the date below.
Actualizado el 15 de septiembre de 2026