GDPR-compliant web analytics

The GDPR governs the processing of personal data — any information relating to an identified or identifiable person (Article 4). The consent obligation that puts a banner on so many sites actually comes from the ePrivacy Directive, which requires opt-in before storing or reading information on a user’s device, such as a cookie.

Pulse is built to sit outside both triggers. It sets no cookies and reads nothing from the device beyond the current tab’s sessionStorage, so the ePrivacy consent requirement does not apply. And it collects no personal data: IP addresses are used only to resolve a country at request time and are then discarded, there is no persistent identifier, and no visitor can be singled out or tracked across sites. With no personal data and no device access, there is no lawful-basis question to answer and no consent to collect.

This is a different posture from “GDPR-ready”. You are not relying on a correctly-configured consent tool, a data-processing addendum and a region setting to stay compliant — the data that would create the obligation is simply never gathered.

Data minimisation is a GDPR principle, not just a nicety: you should collect only what you need. Pulse takes that literally by measuring traffic in aggregate and keeping no individual-level profiles. There is nothing to leak in a breach that could identify a visitor, nothing to hand over in a data-subject access request about a visitor, and nothing to delete on request — because it was never collected.

Jurisdiction matters too. Pulse is operated by Ciphera BV, a Belgian company, with data held on Swiss and EU infrastructure. Your analytics provider is inside the EU and subject to EU law, rather than a foreign company whose home jurisdiction can reach into the data. And because the dashboard and tracking client are open source, your data protection officer can verify what is collected instead of trusting a marketing claim.