The Landscape Has Changed
If you're still running your analytics the same way you did in 2020, you're likely non-compliant. Since the Austrian, French, and Italian data protection authorities ruled standard Google Analytics implementations non-compliant with GDPR in 2022, the enforcement landscape has shifted dramatically.
By 2025, the European Data Protection Board issued updated guidance specifically targeting behavioral analytics, session recordings, and heatmap tools. The fines have gotten larger, Meta was fined €1.2 billion in 2023, and smaller companies have faced penalties in the hundreds of thousands. The message is clear: GDPR compliance isn't optional, and "we didn't know" isn't a defense.
But here's the thing: GDPR doesn't prohibit analytics. It regulates how you collect, process, and store personal data. You absolutely can run a full analytics stack, heatmaps, session replays, A/B tests, and all, while remaining compliant. You just need to do it right.
What GDPR Actually Requires for Analytics
Let's cut through the legal complexity and focus on what matters practically:
1. Lawful Basis for Processing
You need a legal reason to collect analytics data. The two relevant options are:
- Consent: The user explicitly agrees to tracking via a cookie banner or consent mechanism. This must be freely given, specific, informed, and unambiguous. Pre-checked boxes don't count. Cookie walls ("accept or leave") are questionable in most EU jurisdictions.
- Legitimate interest: You can argue that understanding how users interact with your site is a legitimate business interest, but this requires a documented balancing test showing that your interest doesn't override user privacy rights. For basic, anonymized analytics, this can work. For session recordings that capture user behavior in detail, consent is the safer path.
2. Data Minimization
Collect only what you need. GDPR's data minimization principle means you should be asking: "Do we actually need this data point to improve our product?" If you're collecting full IP addresses, precise geolocation, or detailed device fingerprints without a specific analytical purpose, you're over-collecting.
3. Data Processing Agreements
If you use a third-party analytics tool (which you almost certainly do), you need a Data Processing Agreement (DPA) with that provider. The DPA must specify what data is processed, how it's protected, where it's stored, and how long it's retained. Reputable analytics providers offer standard DPAs, if yours doesn't, that's a red flag.
4. Data Transfer Restrictions
This is the issue that tripped up Google Analytics in the EU. If your analytics provider transfers data to the United States or other countries without an EU adequacy decision, you need additional safeguards. The EU-US Data Privacy Framework (adopted in 2023) has helped, but its long-term stability remains uncertain after legal challenges.
The safest approach: choose a provider that offers EU-based data storage and processing.
5. User Rights
Users have the right to access, correct, and delete their data. They also have the right to object to processing. Your analytics setup needs to support these rights, meaning you need a way to find and delete a specific user's data if they request it.
Session Replays and Heatmaps Under GDPR
Session replays and heatmaps deserve special attention because they capture detailed user behavior. Here's how to handle them compliantly:
- Automatic PII masking: Your tool should automatically mask sensitive fields, passwords, credit card numbers, email inputs, phone numbers. If it doesn't do this by default, it's not ready for GDPR.
- Consent for recordings: While aggregated heatmap data may fall under legitimate interest, session replays that record individual user journeys should generally be based on consent.
- Retention limits: Don't store session recordings indefinitely. Set a retention period that matches your analytical needs, 30 to 90 days is common.
- Access controls: Limit who in your organization can view session replays. Not everyone needs access to detailed user behavior data.
A Practical Compliance Checklist
Here's what you should audit in your analytics setup today:
- Cookie consent: Do you have a GDPR-compliant consent banner that loads before any tracking scripts fire? (Not after, before.)
- Consent logging: Do you store proof of consent (timestamp, what was consented to, user identifier)?
- DPA in place: Do you have a signed Data Processing Agreement with every analytics provider?
- Data storage location: Do you know where your analytics data is physically stored? Is it in the EU?
- PII handling: Does your analytics tool automatically mask sensitive information in replays and heatmaps?
- Retention policy: Do you have defined retention periods, and does your tool automatically delete data after that period?
- Opt-out mechanism: Can users easily opt out of analytics tracking after initially consenting?
- Privacy policy: Does your privacy policy accurately describe what analytics data you collect, why, and how users can exercise their rights?
Choosing a Compliant Analytics Tool
When evaluating analytics platforms for GDPR compliance, prioritize these features:
- EU data residency: Data stored and processed within the EU.
- Built-in consent management: Integration with consent banners so tracking only activates after consent is given.
- Automatic PII masking: Sensitive data redacted by default in session replays and form analytics.
- Configurable retention: The ability to set custom data retention periods.
- Data deletion API: A way to programmatically delete a specific user's data to fulfill deletion requests.
- Transparent sub-processors: A published list of sub-processors with notification of changes.
Spectry was built with these requirements as foundational architecture decisions, not afterthoughts. Privacy compliance is embedded in how data is collected, stored, and processed, including automatic PII masking in session replays and EU data residency options.
Compliance Is a Competitive Advantage
Here's the reframe that matters: GDPR compliance isn't just about avoiding fines. In a market where users are increasingly privacy-aware, demonstrating genuine respect for data privacy builds trust. A 2025 Cisco survey found that 81% of consumers say they care about how companies handle their data, and 48% have switched providers over data privacy concerns.
Being transparent about your analytics practices, what you collect, why, and how users can control it. is increasingly a differentiator. Don't treat compliance as a checkbox. Treat it as a signal to your users that you respect them.