What your website analytics collects

Aug 29
3 min read

Updated: 3 days ago

Introduction

Analytics was installed when the site was built, along with an advertising pixel added for a campaign three years ago and a heatmap tool somebody trialled and never removed. Nobody has looked at the configuration since.

The privacy notice describes something quite different, the cookie banner does not block any of it, and the business could not say what data is being collected, where it goes or how long it is kept. This is not unusual and it is one of the more straightforward things to put right. Most of it is settings rather than development work. Nothing here requires a developer or a budget, only somebody willing to open the settings.

1. What your website analytics collects should match what you tell people

The test that matters.

Your privacy notice and cookie information describe your processing. Where the tools on the site collect more than that, or send it somewhere unmentioned, the discrepancy is the problem rather than the collection itself.

2. Find out what is actually installed

Start with an inventory.

Browser developer tools or a free scanner will list every script and tracker. Businesses routinely find tools from former agencies, expired campaigns and abandoned trials still running. Each one collecting data the business cannot account for.

3. Understand what each one collects

More than page views in most cases.

Addresses, device details, behaviour, and in some configurations information entered into forms. Session recording tools in particular can capture considerably more than owners realise. Some capture form contents unless specifically configured not to.

4. Check whether personal data is involved

The question that determines the obligations.

Whether identifiers, addresses or anything that can single somebody out is collected. Many analytics tools do collect personal data in their default configuration, which is what brings them within data protection frameworks. The default configuration is rarely the minimal one. Which in turn means retention, transparency and access rights all apply to them.

5. Configure the tools rather than accepting defaults

Where most improvement is available.

Anonymisation options, shorter retention periods, and disabling data sharing with the provider are frequently available in settings and rarely used. Reducing collection to what you actually use is both simpler and safer.

6. Establish where the data goes

International transfer is a live issue.

Many analytics and advertising services process data in other countries, and most frameworks impose conditions. This has been an area of significant regulatory attention and is worth checking for each tool.

7. Make sure the consent mechanism actually controls them

The common failure.

Non-essential analytics and advertising scripts should not load before consent. A banner that does not block anything provides no protection and misrepresents the position to visitors.

8. Set a retention period

Rarely considered.

Analytics platforms typically allow you to specify how long data is kept, and the default is frequently long. Shortening it is a single setting and reduces both the obligation and the exposure.

9. Remove what you do not use

The simplest improvement available.

Tools nobody looks at, pixels for campaigns that ended, and trials never removed. Each is a collection you must account for and none of them is producing anything for the business. Removing an unused tool is the only change on this list with no downside at all.

Review what you actually use the analytics for. Many small businesses collect a great deal and look at almost none of it, and reducing collection to the handful of measures that inform decisions makes the compliance position easier and the reporting more useful.

Conclusion

Bring what the site collects into line with what you tell people.

Inventory every script and tracker currently installed, understand what each collects, determine whether personal data is involved, configure anonymisation and shorter retention rather than accepting defaults, establish where each service processes data, make sure your consent mechanism genuinely blocks non-essential tools before agreement, set retention periods within the platforms, remove tools you do not use, and reduce collection to the measures you actually act on.