ENFR
Monthly web reporting: build a report leadership will actually read

Monthly web reporting: build a report leadership will actually read

A web report can contain forty pages and produce no decision. Leadership rarely lacks charts. It lacks clear answers to five questions:What changed? Does it matter? Why do we think it changed? What action follows? Can we trust the data?Monthly reporting should be a decision document, not an archive of every available metric. A strong version has one main page, with appendices for investigation. It uses no more than five coherent indicators, contextualised changes and assigned actions. What monthly reporting is for A dashboard answers questions on demand. A monthly report establishes a shared reading at a point in time. It supports goals, detects gaps, explains known changes, records hypotheses, signals measurement limits and coordinates marketing, product, sales and engineering. It should not prove that the analytics team worked. Data volume is not decision quality. Start with the reader Leadership needs trend, target gap, business impact, risk, decision, owner and deadline. Operational teams need channel, page, campaign, event, segment, anomaly and methodology detail. Create two layers:decision summary; diagnostic appendices.The first must make sense without opening a dashboard. A seven-block format 1. One summary sentence Lead with the message, not total traffic. Example:Demo requests increased 18% on stable traffic, mainly through two organic landing pages. Lead quality still needs confirmation through the sales cycle.It contains result, comparison, likely mechanism and limitation. Avoid:The site recorded 42,847 sessions.Without a goal or comparison, the number says little. 2. Three to five KPIsMetric Month Change Target StatusQualified visits 18,240 +4% 18,000 MetDemo requests 126 +18% 120 MetVisit-to-demo rate 0.69% +0.08 pp 0.65% MetSales-accepted leads 61 +7% 70 BelowCollection incidents 2 +2 0 FixStatus follows a defined rule, not decorative colour. For B2B SaaS, the chain might be qualified audience, web conversion, sales quality, acquisition efficiency and measurement health. For content sites, use relevant organic entrances, useful engagement, product transition, signup and technical coverage. A portfolio can use the multi-site governance view as a common baseline with local metrics. 3. Significant changes Do not comment on every row. Select three to five movements above normal noise. Examples:conversions up 22% from one landing page; paid search down after budget reduction; direct traffic up on an untagged email campaign; Search Console impressions changed after a measurement or visibility shift; six hours of missing events; mobile improvement after a performance release.For each, record: Observation Magnitude Scope Hypothesis Evidence ConfidenceThis prevents correlation from becoming certainty. 4. Explanations and confidence Classify explanations:confirmed: documented deployment, budget change or outage; probable: several signals agree; possible: hypothesis to test; unknown: insufficient data.Example:Organic conversions probably increased because two pages gained both Search Console clicks and analytics entrances. Confidence: medium. Sales quality will be available after lead review.Confidence language is more honest than invented causality. 5. Decisions and actionsAction Owner Deadline Success measureApply the proof block to two product pages Content 25 July +10% conversion on tested pagesFix newsletter tagging Growth 15 July Direct share returns to normal on landing pageAudit event loss Engineering 10 July No collection gaps for 30 daysAn action without an owner is an intention. One without success criteria is a task without learning. 6. Data quality Add a visible box: Overall confidence: medium to high Known coverage: public site, excluding customer app Incidents: 6-hour loss on 12 June Changes: new CMP on 18 June Method break: qualified-lead definition changed 1 June Missing data: last 5 days of sales qualificationDo not hide quality in a footnote. Credibility improves when the report says what it does not know. 7. Appendices Appendices can cover sources, landing pages, campaigns, events, Search Console, web performance, segments, methodology, definition history and dashboard links. They support diagnosis, not the main reading. Choose five indicators Connect every KPI to a decision Ask what changes if the metric rises or falls. A metric with no possible action is probably descriptive. Define numerator and denominator A conversion rate can mean conversions per session, visitor, landing-page entry or started form. Write the formula and flag definition changes. Separate volume, efficiency and qualityvolume: demo requests; efficiency: conversion rate; quality: sales-accepted requests.Higher volume with lower quality is not automatically better. Add a reliability metric Examples include valid-event share, time without data, properties in error, consent coverage, unattributed traffic and CRM qualification delay. Measurement has its own performance. Compare the right periods Use previous month for operations, prior year for seasonality when comparable, target for relevance, and moving averages for low-volume trends. Two comparisons are usually enough: June 2026 vs May 2026 June 2026 vs monthly targetNormalise days, working days, time zone, currency, conversion definition, site scope, consent, campaigns and incidents. Use Search Console and analytics together Search Console and analytics observe different objects. Search Console reports Google search clicks and impressions under its rules. Analytics records visits or events collected on the site. Differences can result from incomplete page loads, consent, blocking, time zones, URL grouping, filters, bots and session definitions. Use triangulation:Search Console for visibility, queries and clicks; analytics for landing pages and on-site actions; CRM for quality and revenue.Do not force equality. Add web performance without overload Current Core Web Vitals cover:LCP for loading; INP for responsiveness; CLS for visual stability.Leadership reporting can show the share meeting expectations, trend, critical pages, release impact and action. Use field data where available for real-user experience, with laboratory tests for diagnosis. A one-page example Web performance, June 2026 Summary Demo requests increased 18% on stable traffic. Two organic pages explain most of the growth. Sales-accepted leads remain below target, limiting the conclusion on quality. KPIsKPI Result vs May TargetQualified visits 18,240 +4% 18,000Demos 126 +18% 120Conversion rate 0.69% +0.08 pp 0.65%Accepted leads 61 +7% 70Collection availability 99.2% -0.8 pp 100%Three facts/analytics-guide/ generated 21 demos versus 10 in May. Paid search fell 14% after budget reduction. Direct rose on an email landing page, probably because links lacked UTM tags.DecisionsApply the guide-page pattern to two product pages. Fix the newsletter link generator. Review lead qualification with sales.Data quality A six-hour collection incident affected 12 June. The latest five days of CRM qualification are incomplete. The page can be read in two minutes. Appendices answer follow-up questions. Automate preparation, not judgement Automate extraction, variation calculations, tables, freshness controls, alerts, definition snapshots and draft generation. Keep human review for selecting important facts, validating anomalies, stating hypotheses, assigning confidence and deciding actions. Automation does not know why a campaign stopped, a form changed or a lead category has different value. A monthly calendar Day 1: data checks Verify freshness, incidents, definitions and imports. Day 2: analysis Identify movements, triangulate and prepare hypotheses. Day 3: operational review Marketing, product and sales confirm known changes. Day 4: publication Send the summary with actions. Mid-month: follow-up Check decisions before the next report. The exact schedule can be faster. Keep control, analysis and validation separate. Mistakes that make reporting useless Showing everything An exhaustive report prioritises nothing. Commenting only on growth Growth can remain below target or come from low-quality channels. Hiding incidents They will surface later and undermine the whole report. Claiming attribution without evidence “The campaign caused the increase” needs more than timing. Changing KPIs every month Continuity disappears. Change metrics when strategy changes and record the transition. Reporting team activity rather than outcomes “Ten articles published” is activity. Qualified entries and conversions from content are outcomes, still requiring cautious interpretation. Conclusion A useful monthly report has seven blocks:summary; KPIs; changes; explanations and confidence; actions; data quality; appendices.It keeps leadership informed without hiding complexity. It makes uncertainty visible, connects numbers to targets and assigns every conclusion to an action. Five well-defined indicators reviewed consistently beat fifty ownerless charts. FAQ How long should a monthly report be? The main summary can fit on one page. Appendices may be longer but should remain optional for leadership. PDF or dashboard link? Use a dated summary with access to detail. A short email or document plus dashboard link often works better than an exhaustive export. How many KPIs? Three to five primary KPIs are usually enough. Keep diagnostics in appendices. How should uncertain data be presented? State the limitation, possible cause and confidence. Do not replace missing data with a confident story. Previous month or previous year? Use previous month for operations and previous year for seasonality when scopes are comparable. Target variance is often the most useful comparison. SourcesGoogle Analytics, Reports overview Google Search Console, Performance report web.dev, Web Vitals Google Analytics, Landing page report Google Analytics, Traffic-source dimensions

Read article →
Analytics data retention: what to keep, for how long, and why

Analytics data retention: what to keep, for how long, and why

“We retain analytics data for twenty-five months.” The statement sounds precise but does not say whether it covers raw events or reports, whether visitor identifiers expire at the same time, whether collector logs follow another period, whether backups are purged, whether CSV exports remain on laptops, whether new activity resets the clock, or whether truly anonymous statistics remain longer. A useful retention policy is not one number. It describes the lifecycle of each data layer and connects every period to a purpose. The CNIL states that personal data cannot be kept indefinitely and that controllers should determine retention from the collection purpose. It distinguishes active use, intermediate archiving and, in particular cases, permanent archiving. Web analytics teams usually need a well-limited active dataset, effective deletion and possibly sufficiently aggregated long-term trends. Begin with purpose, not available settings A platform may offer 2, 14, 25 or 50 months. Those options do not determine the right period. Ask:For how long does this individual-level data remain necessary for the defined decision?Examples:seasonal comparison may require more than twelve months of trends; diagnosing collection failures may require only weeks of logs; a long B2B campaign may need several months; retaining a visitor identifier for years “just in case” is harder to justify; an aggregate monthly total may remain useful longer than detailed events.Retention should be proportionate to granularity and risk. Map seven retention layers 1. Terminal trackers and identifiers This includes cookies, local-storage IDs, session identifiers and other persistent mechanisms. Document initial duration, renewal, domain scope, cross-site use, withdrawal deletion and consent expiry. For certain audience-measurement trackers that may meet the French exemption conditions, the CNIL recommends a lifetime allowing meaningful comparison, such as thirteen months, without automatic extension at every visit. That does not make thirteen months correct for every identifier. It is a benchmark tied to the specific framework and conditions. 2. Raw events Events contain the most detail: timestamp, page, source, device, event properties, identifiers and technical metadata. They support diagnostics, funnels and report reconstruction. Their granularity increases singling-out risk and governance cost. Ask whether raw events are needed beyond the analysis cycle, whether they can be aggregated after 30, 90 or 180 days, which fields can disappear earlier, whether invalid events are stored, and whether schema deletion affects history. 3. Pseudonymised data A replaced, hashed or rotating identifier is not automatically anonymous. If events can still be linked, treat this layer cautiously. Define method, re-identification possibility, table separation, access, rotation, mapping-table deletion and the real need for continuity. Rotation helps only when old periods cannot be reconnected without a justified process. 4. Aggregate statistics Daily or monthly reports can sometimes remain longer, especially when they no longer single out a person. Examples: monthly visits by site monthly conversions by channel weekly page views by content category quarterly conversion rate“Aggregate” is not magic. A cell with one conversion in a small region may still reveal information. Set thresholds, reduce dimensions and test sparsity. If data are truly anonymous, GDPR personal-data rules no longer apply. That conclusion requires evidence. 5. Technical logs Collectors, CDNs, reverse proxies and applications may keep IP addresses, full URLs, user-agents, errors, rejected payloads and request IDs. Logs are frequently missed because they do not appear in the analytics dashboard. They serve separate security, availability and diagnostic purposes. Give them a separate period, restricted access and sensitive-field filtering. 6. Backups A backup is not a permanent deletion exception. Document frequency, rotation, encryption, access, restoration, treatment of previously deleted data, purge timeline and offline snapshots. Immediate editing of every backup may be impractical. In that case, limit access and duration, and prevent restored expired data from returning to active use. 7. Exports and secondary systems Exports create parallel retention:emailed CSV files; spreadsheets; warehouses; BI systems; agency storage; presentations; support tickets; local backups.The vendor's setting does not erase these copies. Every export needs an owner, purpose, approved location, period, access rule and deletion method. Reducing exports is often simpler than governing many copies. Build a retention matrix An illustrative SaaS matrix:Layer Purpose Proposed period Trigger Deletion OwnerLimited visit identifier Trend measurement Up to 13 months under the assessed framework Creation, no automatic renewal Expiry Analytics ownerRaw events Analysis and diagnostics 6 months Event date Automated job DataAggregate monthly reports Historical steering 36 months Month end Aggregate then purge Finance/GrowthCollector logs Security and errors 30 days Receipt Rotation EngineeringBackups Recovery 60 days Snapshot creation Rotation InfrastructureOne-off exports Defined analysis 90 days Export date Owner deletion AnalystConsent evidence Demonstrate choice Defined from risk and limitation periods Choice Dedicated policy PrivacyValues are illustrative unless a specific framework is cited. Another organisation can reach different periods after assessment. Define the trigger. Six months from collection differs from six months after last visit, campaign close or contract termination. Understand platform settings GA4: explorations versus aggregate reports GA4 documentation says retention controls apply to user-level and event-level data. Standard properties document options including 2 or 14 months for user and event data. Google also says the setting does not affect standard aggregate reports and applies to surfaces such as Explorations and funnel reporting. A team can therefore believe it reduced all retention while aggregate reporting remains available. “Reset on new activity” can extend certain user-data expiry with each event. Check whether that matches policy. Other vendors Privacy-first SaaS, self-hosted platforms and cloud tools differ in fixed or configurable periods, raw-event availability, aggregate retention, provider backups, site deletion, APIs and contract-end deletion. Do not copy a period from a comparison article. Verify current documentation and contract terms. The CNIL twenty-five-month recommendation For audience-measurement trackers under the French exemption framework it describes, the CNIL recommends a maximum of twenty-five months for collected information, with periodic review. Three cautions:maximum is not the default: less may be sufficient; the framework is conditional: purpose, anonymous statistics, no combining and other conditions still matter; layers remain separate: logs, exports and identifiers need their own assessment.A policy can therefore keep detailed events for six months and aggregate reports for twenty-four, when justified. It should not copy twenty-five months into every database. Test deletion An untested policy is an intention. Test 1: expired data Use test events or a short-period environment. Verify disappearance from storage, APIs and affected reports. Test 2: identifiers Check cookie or identifier expiry, renewal and withdrawal behaviour. Test 3: exports Track a file from creation to deletion, including copies, attachments and recycle bins. Test 4: restored backups Restore into an isolated environment and verify that deletion rules are reapplied or expired data are blocked from use. Test 5: contract termination Ask the vendor about export windows, deletion date, backups, confirmation, legally retained data and subprocessors. Avoid silent extensions Retention can be prolonged by cookie renewal, user-row updates, warehouse imports, sparse aggregates, never-rotated backups, shared-folder copies, reused test accounts and changes applying only to future data. Document whether a change acts retroactively. Retention across multiple sites One policy may not fit a corporate site, authenticated app and help centre. Purposes, data, risks and countries differ. Use a common baseline with approved exceptions. The multi-site dashboard can show collection health, while administration tracks the retention mode and review date of every property. Do not share a cross-site identifier merely to simplify retention. Who validates the period? Business owners explain need. Analytics describes granularity. Engineering confirms deletion. Security owns logs. Privacy reviews the framework. Infrastructure covers backups. Procurement checks contracts. Name a final owner. “Data team” is not enough. The data collection summary and analytics privacy notice should show consistent periods at different levels of detail. A quarterly ten-question reviewHave purposes changed? Are detailed data still used? Can long-term reports be more aggregated? Do identifiers renew? Did deletion jobs succeed? Are there new exports? Are backups rotating? Did vendor policy change? Are public documents aligned? Can an inactive property be deleted?Removing an unused site, export or event is often the strongest risk reduction. Conclusion Retention is not a number in a policy. It is a system connecting purpose, granularity, access, trigger and deletion. A sound policy:separates identifiers, events, aggregates, logs, backups and exports; justifies each period; avoids silent renewal; tests purge operations; documents exceptions; aligns tools, contracts and public information.Begin with the most detailed data. Ask how long it remains useful, then aggregate or delete. Long-term history should not require indefinite individual-level collection. FAQ Does the CNIL always require twenty-five months? No. It recommends a twenty-five-month maximum for collected information under the conditional framework for certain audience-measurement trackers. A shorter period may be sufficient or necessary. Can aggregate statistics be kept indefinitely? Only when they are truly anonymous or another framework justifies retention. Sparse or highly segmented aggregates can still single out people. Does GA4 retention remove all reports? No. Google states that user and event retention settings do not affect standard aggregate reports. Understand which data and surfaces are covered. Must backup data be deleted immediately? It depends on architecture and risk. Backups need limited rotation, controlled access and procedures preventing expired data from returning to use after restoration. When does the retention clock begin? Define the trigger: collection, last activity, campaign close, aggregation or contract termination. Avoid automatic renewal where the framework or policy does not allow it. SourcesCNIL, Data retention periods CNIL, Audience-measurement cookies and consent conditions Regulation (EU) 2016/679, Article 5(1)(e) Google Analytics, Data retention Plausible, Data policy CNIL, Practical guide to retention periods

How to choose an analytics tool: a 15-question governance scorecard

How to choose an analytics tool: a 15-question governance scorecard

Analytics comparisons often begin with feature lists and end with an overall score that assumes every team wants the same thing. They do not. A B2B small business measuring three sites, sharing reports with an agency and limiting collection has different constraints from an ecommerce group connected to advertising platforms. A technical team willing to operate self-hosted software makes a different trade-off from a marketing team without systems administration. The best tool is not the one with the most features. It is the one whose capabilities, defaults and governance model fit the need. The existing Google Analytics, Matomo and lightweight analytics comparison explains the main families. This scorecard supports an actual procurement decision without relying on a static ranking or prices that will change. Write the problem before scoring tools A serious selection fits on one page before the first demo. Decisions to support List five to ten decisions:Which channels create qualified requests? Which landing pages contribute to conversion? Which content is used? Which sites are growing or declining? Which product events matter? Where did collection break?“Collect all the data” is not a decision. Users Identify marketing, product, management, agency, analyst, engineering, privacy and external-client roles. The key issue is not only user count. It is rights, skills and usage frequency. Constraints Document site count, expected volume, countries, consent requirements, prohibited data, retention, integrations, budget, operating capacity, migration timeline and contractual requirements. This prevents a polished demo from replacing analysis. The 15-question scorecard Score each tool from 0 to 3:0: unavailable or incompatible; 1: possible with a major workaround; 2: covered with acceptable configuration or limits; 3: naturally supported and documented.Apply a weight from 1 to 3 for your organisation. 1. Can it answer business questions without heavy reconstruction? Test five scenarios, such as campaign landing pages, demo requests, three-site comparison, monthly export and traffic-drop diagnosis. A powerful tool that real users cannot operate is expensive. 2. What granularity is genuinely required? Separate aggregate statistics, events, journeys, cohorts, funnels, user identifiers, advertising data and session replay. Each layer adds capability and governance. A team using only pages, sources and conversions should not select primarily for detailed behavioural analysis. 3. What does the default setup collect? Check cookies or identifiers, IP address, full URL, user-agent, geography, advertising IDs, automatic events, query parameters and cross-site signals. Use the URL parameter audit and inspect a test payload. A default aligned with policy scores better because every option to disable is configuration debt. 4. Are strict and extended modes clearly separated? Some teams want minimal measurement by default where the local framework allows it, with extended capabilities after consent. Assess configuration separation, pre-consent behaviour, signal propagation, accidental activation risk, change history and documentation. A vague privacy switch is not enough. 5. Can you explain the data flow? You should be able to state where requests arrive, which transformations occur, where data are stored, which subprocessors participate, whether the vendor reuses data, which support access exists and which transfers apply. Use the data collection summary as the evaluation format. 6. Do location and transfers fit your constraints? Assess hosting region, contracting entity, subprocessors, remote access, transfer mechanisms and self-hosting options separately. “EU hosted” is one fact, not a complete assessment. Self-hosting provides control while transferring operational duties to the team. 7. Can retention, deletion and backups be governed? Ask about available periods, raw versus aggregate data, automatic deletion, property-level deletion, backup purge, exports, contract-end deletion and operational evidence. Unlimited default retention is not neutral. 8. Do multi-site permissions fit? Test per-site roles, groups, agency access, read-only access, exports, admin logs, SSO where needed, offboarding and portfolio views. The multi-site dashboard model turns these into practical scenarios. 9. How does it handle data quality? Review bots, test environments, duplicates, invalid events, unknown parameters, ingestion delay, definition changes, alerts, time zones and cardinality. A simple report without diagnostics may be too shallow. A rich platform with opaque transformations may be hard to audit. 10. Can events and conversions remain governed? Test event creation, change and deprecation. Can schemas be validated? Can fields be forbidden? Are changes versioned? Do historical goals remain understandable? Can an agency change collection without approval? Easy event creation is not always an advantage. Missing guardrails quickly creates an unreadable taxonomy. 11. Is acquisition readable without excessive setup? Test source and medium, UTM campaigns, referrers, direct, landing pages, conversions, custom channels and only the attribution models you genuinely need. Platforms can classify the same journey differently. Ask how rules are defined and changed. 12. Can history be migrated and compared? Check import availability, format, granularity, supported metrics, cost, duration, definition differences, source-data preservation and break-point labelling. An import does not erase differences in sessions, visitors or conversions. 13. Is cost predictable at your scale? Include subscription by volume, overages, sites, users, modules, storage, hosting, maintenance, support, consent management, configuration time, manual reporting, migration and exit. For self-hosting, include updates, backups, monitoring, security and availability. For SaaS, model traffic growth and plan-gated features. Verify prices at decision time. 14. What operating burden can the team sustain? List installation, configuration, tests, maintenance, access, compliance, alerts, backups, support, training and documentation. A free tool can be expensive to operate. A simple tool can be expensive if every useful question requires manual exports. 15. Can you exit cleanly? Evaluate full export, open formats, API, post-cancellation access, deletion, portable configuration, event recovery, definition history and proprietary identifier dependence. A good fit today can still create future debt through lock-in. A weighting example For a multi-site B2B SaaS company:Criterion WeightBusiness questions 3Granularity 2Default collection 3Strict/extended separation 3Data flow 3Location and transfers 2Retention and deletion 3Multi-site access 3Data quality 2Event governance 2Acquisition 2Migration 2Total cost 3Operating burden 3Reversibility 2Calculate: sum(score × weight) / sum(3 × weight)A percentage is convenient, but a two-point difference is not scientific truth. The criteria discussion matters more than the final rank. Add disqualifying criteria Some conditions cannot be offset:unavailable DPA; no deletion; no export; prohibited data collected without control; incompatible multi-site access; unacceptable transfer; cost beyond budget; impossible operating burden; missing essential capability.A tool can score 85% and still fail one critical requirement. Reading the main tool families Rich analytics and advertising suites GA4 integrates deeply with Google's ecosystem and provides broad dimensions, explorations and advertising connections. This can fit trained teams with real attribution and activation needs. It also requires more event governance, configuration and understanding of scopes. Familiarity alone is not a selection criterion. Controllable and self-hostable platforms Matomo offers cloud and self-hosted options with broad functionality. Umami and other open-source projects take more compact approaches. Self-hosting increases infrastructure control, but the organisation owns operations. Decide who patches, restores backups and monitors access. Privacy-first analytics SaaS Plausible, Fathom, Simple Analytics and related tools prioritise readable reporting and often more limited collection. They can reduce setup for essential needs. Simplicity may limit advanced analysis, complex event schemas or some consolidation patterns. Verify actual capabilities, not only philosophy. Emerging products A beta or launch-stage product may align well with governance, but assess maturity, documentation, support, export, stability and demonstrated roadmap. Never score a roadmap promise as an available feature. Run a two-week pilot Day 1: confirm scenarios Select five questions, three roles and two representative properties. Days 2 to 4: deploy a small scope Install each candidate on a test environment or pilot property with the same pages and events. Days 5 to 7: audit collection Compare network requests, documented storage, consent, URL parameters and access. Days 8 to 10: user tests Ask marketing, product and administration users to complete the same tasks without excessive assistance. Days 11 to 12: test export and deletion Export data, revoke access, change retention and review deletion procedures. Days 13 to 14: score and document Complete the scorecard, list disqualifiers and write down accepted compromises. Common selection mistakes Choosing from a demo A demo shows the best workflow, not routine operations. Choosing on privacy alone Privacy is a major design constraint, but the tool must support decisions. An unused solution does not improve governance. Choosing on features alone A feature that expands collection or requires a dedicated team can be a cost rather than value. Comparing prices without future volume Model twelve- and twenty-four-month scenarios. Forgetting people The theoretical best tool fails when nobody understands its reports or maintains its rules. Conclusion A useful comparison does not ask, “Which tool is best?” It asks, “Which tool creates the best compromise for this organisation?” The scorecard makes visible:expected decisions; default collection; governance; access; retention; multi-site needs; total cost; operating burden; exit capability.The result is not a universal score. It is an explainable, reviewable and documented decision. FAQ How many tools should be tested? Three well-chosen candidates are often enough: a rich reference platform, a more controllable option and a simple privacy-first option. Add a fourth only when it represents a genuinely different model. Is self-hosting always more compliant? No. It increases potential control, but compliance still depends on configuration, security, access, purpose, retention and real operations. Can prices be compared once and reused? No. Plans, limits and prices change. Verify them at decision time and model several volumes. How should a roadmap feature be scored? Treat it as unavailable until it can be used and verified. A roadmap can affect risk, but it cannot satisfy a current requirement. What is the difference between a weighted and disqualifying criterion? A weighted weakness can be offset by other strengths. A disqualifying criterion makes the tool incompatible regardless of its total score. SourcesCNIL, Audience-measurement cookies and consent conditions Regulation (EU) 2016/679, data minimisation, transparency and accountability principles Google Analytics, Analytics account structure Google Analytics, Data retention Matomo, Privacy Plausible, Data policy Fathom Analytics, Data policy Umami, Documentation

Analytics privacy notice: useful wording and claims to avoid

Analytics privacy notice: useful wording and claims to avoid

A privacy notice can be legally dense and technically wrong. A common example says “we only use anonymous data” while the site sends full URLs, campaign identifiers and IP addresses to several providers. At the other extreme, some notices list twenty abstract categories without helping readers understand what analytics actually does. Quality comes from alignment between:deployed collection; purposes; roles; consent or another applicable framework; retention; rights; the words used.The GDPR requires information to be concise, transparent, intelligible and easily accessible. Articles 12, 13 and 14 govern much of the content. A useful analytics notice should remain readable while describing important facts with enough precision. This is an editorial and operational method, not a universal clause or legal opinion. Start with reality, not a downloaded template Collect four internal sources before writing:the tracker inventory; the data collection summary; contracts, DPAs and subprocessor lists; consent and retention configuration.The notice is the public view of verified facts. It should not be used to guess how the site works. A legal template can structure headings. It cannot know whether you collect a full URL, store IP addresses, create a visitor identifier, allow vendor reuse, send free text, activate extended analytics after consent, export to a warehouse, or share identifiers across sites. Those answers must come from the audit. Use layered information One ten-page policy is not always the best entry point. Layer 1: information at the relevant moment Near the choice or collection, state the essentials:purpose; controller; required or optional nature; link to details; means to accept, refuse or withdraw where consent applies.For strictly limited measurement assessed as not requiring consent, a short notice can link to the analytics section. Layer 2: dedicated analytics section Explain:what is measured; why; how data are reduced; which provider is involved; how long information remains; how to exercise rights or ask questions; which capabilities depend on consent.Layer 3: detailed documentation A technical page or collection sheet can explain fields and transformations. It does not replace GDPR information, but it gives interested readers detail without overloading the first layer. Every layer must tell the same story. Sections to cover 1. Controller identity Name the entity that determines purposes and means, with contact details. In a group, the visible brand is not necessarily the legal controller. Include DPO details where applicable, or a clearly identifiable privacy contact. Useful wording:The controller for audience-measurement data on this site is [entity], available at [address or form]. For data-protection questions, contact [DPO or privacy contact].Avoid:We respect your privacy.It states an intention but identifies nobody. 2. Specific purposes Separate purposes instead of using “improve your experience” for everything. Examples include:measuring visits and viewed pages; detecting navigation errors; understanding acquisition sources; measuring demo requests; producing aggregate statistics; personalising content; measuring advertising campaigns.These do not necessarily share one legal framework. If minimal analytics runs by default and extended analytics starts after consent, say so. Useful wording:We use limited audience measurement to understand visit volume, viewed pages and main traffic sources. Enriched attribution and [other capability] are enabled only after your choice when consent is required.Avoid:We collect data to improve our services and offers.It is too broad. 3. Data categories and signals The notice need not reproduce every technical key, but it should be concrete. Depending on the setup:page path; visit time; referrer domain; approved campaign parameters; reduced device and browser class; approximate country or region; conversion event; optional pseudonymous identifier; temporarily received IP address; consent choice.Distinguish stored data from data used transiently to produce an aggregate result. Useful wording:For each visit, we record the page path, time, referrer domain when transmitted, device category and approved campaign parameters. The IP address is [describe exact handling]. Form contents are not sent to analytics.Avoid:We collect no personal data.An IP address, identifier or combination of signals may be personal data depending on the processing. 4. Legal basis and tracker framework Do not merge:storing or accessing information on the terminal under ePrivacy and national law; the GDPR legal basis for personal-data processing.The analytics consent checklist explains the distinction. Depending on the facts, the notice may refer to consent, legitimate interests after appropriate assessment, limited audience measurement under a conditional national exemption, or strictly necessary functionality. Do not use a legal basis as a marketing badge. Explain how the choice operates or how the assessment is documented. Avoid:Our tool is CNIL compliant, so consent is not needed.The CNIL states that the conditions depend on setup and context, and that providers cannot claim certification or approval based on its self-assessment. 5. Recipients and providers Identify recipient categories and, where it improves transparency, key providers. Explain roles for internal authorised teams, analytics vendor, hosting provider, technical support, agency and data warehouse. “Trusted partners” is not specific enough. Assess whether each provider is a processor, independent controller or another role based on the facts and contract. 6. International transfers Where data are accessible or transferred outside the EEA, explain relevant countries or categories, mechanisms and how to obtain more information. Do not confuse hosting region, vendor headquarters, support access, subprocessors and legal transfer. “Hosted in Europe, therefore no transfer” requires verification of the entire chain. 7. Retention A phrase such as “as long as necessary” needs concrete periods or criteria. Separate:tracker or identifier; raw events; aggregate reports; security logs; backups; exports.Useful wording:Analytics events are retained for [period]. Aggregate statistics remain for [period or criterion]. Technical logs have a separate [period]. Manual exports are deleted under [procedure].For the French CNIL framework, the thirteen-month tracker-lifetime and twenty-five-month collected-information recommendations are reference points to assess, not values to copy blindly. 8. Rights Explain applicable rights and provide a simple contact method. Depending on basis and processing, rights may include access, rectification, deletion, restriction, objection or portability. Truly anonymous analytics may not permit identification for an individual request. Explain this precisely rather than using anonymity as a blanket exception. Include the right to lodge a complaint with the competent supervisory authority. 9. Withdrawal or objection Where consent applies, provide an accessible way to withdraw it according to applicable rules. Where another basis applies and a right to object exists, explain the process. A “manage cookies” link must work on mobile, remain visible and change actual tag behaviour. 10. Date and changes Add a last-updated date and a process for material changes. Review the notice when the team adds a tool, purpose, identifier, retention period, export, provider, country or consent change. A concise change history can help returning readers. A short section to adapt This is an editorial skeleton, not a publication-ready clause.Audience measurement We use [tool] to measure visits, viewed pages and main traffic sources. This helps us detect navigation problems and evaluate content usefulness. Depending on our configuration, processed data include [concrete list]. [Describe IP and identifier handling]. Form contents and unapproved URL parameters are not sent. [Provider] acts as [role] and processes data in [relevant locations and transfers]. Data are retained for [periods by layer]. [Explain the ePrivacy framework and GDPR legal basis, including consent operation where applicable]. You may exercise your rights or ask a question at [contact]. You may [withdraw consent / object] through [method].Every bracket requires a verified answer. Wording that weakens credibility “Completely anonymous data” Use this only when the method supports the claim and the information can no longer reasonably identify or single out a person. Otherwise use precise descriptions such as aggregate data, identifiers removed, pseudonymised data, reduced granularity or IP address not retained in events. These terms are not interchangeable. “No data are shared” When a provider hosts or processes collection, it receives data as part of the processing. “Data are not sold” or “not used for advertising” may be accurate, but “no sharing” is often not. “GDPR compliant” Compliance depends on the controller, purpose, setup, contract and operations. Describe measures instead of issuing a universal verdict. “Necessary cookies” Explain necessary for what. A marketing team finding a tracker useful does not make it technically necessary. “We may change this policy at any time” This does not explain material-change handling. Add a date and an appropriate notification process where required. Align the notice with product delivery Policies are often reviewed annually while stacks change weekly. Add a release control:every new tag request states purpose, data and provider; the privacy or analytics owner assesses impact; the collection summary is updated; the notice and CMP change where necessary; deployment is tested; evidence is retained.For URLs, apply the parameter allowlist before the notice promises reduced collection. A twelve-question editorial audit Ask:Is the controller identifiable? Are purposes separated? Are data described concretely? Is temporary receipt distinguished from storage? Is the GDPR legal basis stated? Is the tracker regime explained without shortcuts? Are providers and roles clear? Were transfers verified? Are retention periods concrete? Are rights and contact accessible? Does withdrawal or objection work? Does the text match the current network and configuration?A negative answer triggers a correction to the stack, the text, or both. Conclusion A good analytics privacy notice does not reassure through adjectives. It provides understandable facts. It explains who measures, why, with which signals, for how long, through which providers, under which framework and with which controls for individuals. Start from the technical inventory, write in layers, validate necessary legal qualifications and connect every stack change to documentation updates. Transparency is not separate from the product. It is the public description of its governance. FAQ Should the analytics vendor be named? The GDPR requires information about recipients or recipient categories. Naming the main provider often improves clarity, although the precise form depends on the processing and notice structure. Can the notice say data are anonymous? Only when anonymisation is demonstrated. Pseudonymised, aggregated or IP-free data are not automatically anonymous. Does the notice replace a consent banner? No. The notice provides detail. Where prior consent is required, a valid choice must occur before covered trackers start. Must every analytics event be listed? Not necessarily in the first layer. Use concrete categories and provide deeper documentation where useful. Sensitive or unexpected events require explicit assessment. What if a vendor changes subprocessors? Assess recipients, transfers, contracts and risk, then update documentation and information where necessary. SourcesRegulation (EU) 2016/679, Articles 12, 13 and 14 CNIL, Examples of privacy information notices CNIL, Informing individuals CNIL, Audience-measurement cookies and consent conditions EDPB, Guidelines on transparency under Regulation 2016/679

Analytics consent: what to verify before promising “no cookie banner”

Analytics consent: what to verify before promising “no cookie banner”

“Cookieless analytics” is often shortened to “consent-free analytics” and then to “no cookie banner”. Those statements are not equivalent. A tool can avoid HTTP cookies while reading or writing information on a device through another mechanism. A product may offer a limited audience-measurement configuration while other modules require a different assessment. And even when analytics fits a strict framework, videos, support widgets, advertising pixels or embedded forms elsewhere on the site may still require consent. The right question is not, “Is the tool cookieless?” It is:Which trackers and processing operations are actually deployed on this site, in this configuration, for which purposes and under which conditions?This is an assessment framework, not legal advice. It must be adapted to the countries, uses and setup involved. Do not confuse three layers 1. Storage or access technology A cookie is one technique. The ePrivacy framework more broadly addresses storing information on a user's terminal or accessing information already stored there, as transposed in national law. Local storage, SDKs, pixels, fingerprinting mechanisms and other terminal access can therefore raise consent questions without a traditional HTTP cookie. Cookieless is a technical characteristic, not a complete legal classification. 2. The ePrivacy tracker regime In France, Article 82 of the Data Protection Act implements the tracker rules. The general principle is prior information and consent for covered operations, with exceptions including operations strictly necessary for a service expressly requested. The CNIL also describes conditions under which certain audience-measurement trackers may fall within an exemption. This is a narrow framework, not a general exemption for all analytics. 3. Personal-data processing under the GDPR Even when a terminal operation does not require ePrivacy consent in a particular configuration, GDPR duties can still apply if personal data are processed. Purposes, legal basis, transparency, minimisation, retention, recipients, transfers, security and rights may still need to be documented. No banner does not mean no processing or no information. The French limited audience-measurement conditions The CNIL states that, to remain strictly necessary for the service and potentially fall within the described exemption, trackers must in particular:be strictly limited to measuring the audience of the site or app; operate exclusively on behalf of the publisher; produce anonymous statistics only; avoid combining the data with other processing; avoid transmitting non-anonymous data to third parties; avoid global tracking across websites or apps.The CNIL also recommends informing users, limiting tracker lifetime, for example to thirteen months without automatic extension, retaining collected information for no more than twenty-five months, and reviewing those periods. Each condition matters. Strictly limited purpose Technical performance, viewed content and navigation problems may fit the described logic. Advertising audiences, CRM enrichment, ad personalisation and cross-service tracking do not share the same purpose. One product interface may offer both. Audit the enabled feature, not only the vendor name. Exclusively for the publisher The provider should not turn the collection into data for its own targeting, profiling or incompatible cross-client measurement. Review the contract, product documentation and subprocessors. A marketing statement is not enough. Anonymous statistics “Anonymous” is a demanding word. Removing a name, truncating an IP address or hashing an identifier does not automatically create anonymity. If a signal still distinguishes or connects a person, use cautious terminology. Ask the vendor to explain transformations and re-identification risk. No global cross-site tracking A shared identifier used to deduplicate people across properties changes the scope. This matters for groups and agencies consolidating audiences. A multi-site dashboard can aggregate indicators without requiring a cross-site person identifier. The checklist before any no-banner promise 1. Inventory the whole site Do not begin and end with analytics. Include:analytics; tag managers; embedded video and maps; support chat; forms; fraud prevention; experimentation; session replay; advertising; social widgets; security and CDN tooling; partner scripts; mobile SDKs where relevant.Run a tracker audit before and after each consent choice, across several pages and journeys. Strict analytics does not neutralise an advertising pixel elsewhere. 2. State real purposes For every component, state what it enables:aggregate audience statistics; campaign analysis; personalisation; advertising; security; interaction recording; support; product experimentation.“Improve the service” is too broad to govern a configuration. 3. Identify terminal operations Document cookies, local storage, session storage, cache identifiers, SDKs, pixels, device characteristics, consent signals and withdrawal. A scanner showing no cookies does not close the assessment. 4. Inspect collected data and transformations The data collection summary should answer:Is the IP address received, used and stored? Is the full URL transmitted? Is the user-agent raw or reduced? Is a visitor identifier created? Is it stable across days or sites? Are UTM parameters retained? Can free-form events contain text? Which data are aggregated? At what point can a record no longer single someone out?An “anonymous mode” that nobody can explain is not evidence. 5. Review vendor use Ask whether the vendor:acts only as a processor for this collection; reuses data for its own purposes; combines data between customers; produces benchmarks from individual-level data; trains another product; sends data to subprocessors; makes international transfers.Benchmarking can sometimes be designed on separated aggregate data. It still needs to be understood. 6. Verify the exact configuration Documentation may say “can be configured to meet the criteria”. That does not mean your default account does. Keep evidence of:configuration export or screenshots; script version; collection parameters; disabled modules; allowed domains; retention; sharing options; verification date; owner.The CNIL tells publishers to request documentation and operating instructions from providers. 7. Review retention Separate tracker or identifier lifetime, raw events, statistics, technical logs, backups and exports. Test automated deletion. A dashboard retention setting may not cover files exported by your team. 8. Inform visitors Even when consent is not required for a strictly framed measurement setup, the CNIL recommends informing users, for example in the privacy notice. Depending on context, explain purpose, relevant data, general operation, duration, provider, recipients, rights, contact and relevant transfers. “We use privacy-friendly analytics” is not enough. 9. Test refusal and withdrawal Where part of the stack relies on consent:covered trackers must not start before the choice; refusal must follow applicable interface requirements; withdrawal must have an effect; the signal must reach all relevant tags; new pages and components must respect the choice.Test behaviour, not only the CMP appearance. 10. Validate and retain the assessment The controller makes the final decision, with DPO or legal support where appropriate. Record:countries; purposes; inventory; criteria reviewed; vendor evidence; configuration; tests; residual risks; date and owners; review triggers.The answer may differ for a French corporate site, an authenticated app and an international property group. Cookieless, consent mode and no banner Cookieless The term can mean no persistent cookie, no cookie in one mode, alternative storage, identifier-free events, server-derived identifiers or simply no advertising cookie. Ask for the technical definition. Consent mode A consent mode communicates user choices to tags and can change their behaviour. Depending on the product and setup, signals may still be sent without advertising cookies. It helps implement a decision. It does not decide whether no-consent collection is legally permitted, and it does not turn advertising into strictly necessary measurement. No banner This statement can only be assessed across the complete site. It may be reasonable when no non-essential component runs before consent and the audience measurement genuinely meets the applicable framework. It is misleading when based only on the absence of an analytics cookie. Claims to avoidabsolute GDPR or legal-compliance claims; blanket consent-exemption claims; claims that cookie-free analytics automatically remove every banner; claims of official CNIL certification; claims of official CNIL approval; “No personal data” “No legal assessment required”The CNIL explicitly states that a solution cannot present itself as certified or approved by the authority merely because of the audience-measurement self-assessment. More accurate wording includes:“cookieless by default”; “designed for minimal collection”; “can be configured for limited audience measurement”; “exemption depends on purposes, configuration and context”; “users remain informed”; “the complete site stack must be audited”.Precision protects credibility as well as compliance. When a banner remains necessary Depending on applicable law and configuration, consent is generally still relevant for:personalised advertising; retargeting; ad-network sharing; cross-site tracking; profile enrichment; some session-replay uses; non-essential personalisation; third-party embeds with non-essential trackers; analytics beyond a limited measurement purpose.The existing guide to session replay and the CNIL consultation explains why detailed behavioural recording should not be treated like aggregate audience statistics. A simple decision process Case A: strictly limited measurement Minimal collection, no cross-site tracking, no vendor reuse, anonymous statistics, controlled retention, information and documentation. Action: assess and document the local framework, then inspect the rest of the site. Case B: enriched analytics after consent The team wants detailed events, advanced attribution or more persistent identifiers. Action: block the relevant capabilities until consent, transmit the choice correctly and document the processing. Case C: mixed stack Minimal measurement runs by default, with extended modules enabled after consent. Action: separate the modes technically, prevent reporting changes from silently expanding collection, and test every transition. Clear separation is more credible than one setting claimed to fit every use. Conclusion A no-banner promise cannot be inferred from “cookieless”. It follows from an assessment of the complete site, purposes, terminal operations and configuration. Before communicating, verify:every component; purposes; terminal access; data and identifiers; vendor use; configuration; retention; transparency; consent behaviour where applicable; the documented decision.The result may be a no-banner strict stack, a consent-based extended stack, or a clearly separated combination. Quality comes from the distinction, not the slogan. FAQ Is cookieless analytics automatically exempt from consent? No. Assess other terminal operations, purposes, data, identifiers and applicable national law. Cookieless is a technical feature, not a legal conclusion. Does the CNIL certify exempt analytics tools? No. The CNIL provides criteria and a self-assessment tool but says providers cannot present that self-assessment as official certification or approval. Can visitors be informed without a banner? Yes, when consent is not required for the relevant collection, information can be provided in a privacy notice or another appropriate location. It must remain clear and accurate. Do UTM tags prevent an exemption? Not automatically, but their use and combination must remain compatible with the limited purpose, minimisation and absence of cross-site tracking. They must never contain personal data. Who decides whether the site can operate without a banner? The controller makes and documents the decision, supported by a DPO or legal adviser where needed. A vendor alone cannot guarantee the answer for every site. SourcesCNIL, Audience-measurement cookies and consent conditions CNIL, What does the law say about cookies and trackers? Directive 2002/58/EC on privacy and electronic communications EDPB, Guidelines 05/2020 on consent EDPB, Guidelines 2/2023 on the technical scope of Article 5(3) ePrivacy