General Data Protection Regulation (EU)
What the GDPR covers, and what it means for your website analytics
Official name: Regulation (EU) 2016/679, the General Data Protection Regulation. In force since 25 May 2018, it governs how personal data is processed in the EU and EEA, including when it is transferred outside them.
See all privacy lawsAt a glance
The EU's rulebook for personal data
The GDPR sets one standard for personal data across the EU and EEA. Every use of personal data needs one of six legal bases, such as consent or legitimate interest, and you should collect only what you need.
People can see the data you hold on them, correct or delete it, object to how it's used and take it elsewhere. Changes proposed in the EU's Digital Omnibus package are still being negotiated, so the current rules apply in full.
Who it covers
Organizations in the EU, and those elsewhere that serve or monitor people there
What it means for websites
IP addresses and cookie IDs count as personal data, so analytics needs a legal basis
Who enforces it
National data protection authorities, coordinated by the EDPB
Maximum fines
Up to €20 million or 4% of global annual turnover, whichever is higher
Further reading
Everything you need on this law
The GDPR
The official text of Regulation (EU) 2016/679, the General Data Protection Regulation.
Read the official textGDPR rules for businesses
The European Commission’s plain-language guide to what the GDPR asks of businesses and organizations.
Read the guideEDPB guidelines
The official interpretation of the GDPR from the board of EU data protection authorities.
Browse the guidelinesThe ePrivacy Directive
The EU cookie law that works alongside the GDPR and decides when you need consent to access a visitor’s device.
Read our ePrivacy guideTWIPLA and the GDPR
Full analytics on a legal basis that needs no consent
In Maximum Privacy Mode, TWIPLA's default, the legal basis is legitimate interest under Art. 6(1)(f) GDPR: understanding how your website is used, without profiling anyone. You don't need visitor consent.
The data itself is kept to a minimum:
- IP addresses are used in memory for an approximate location, then discarded
- Visitors are counted with a one-way hash, the only identifier stored
- Reports show trends across your audience, never one person's page history
- All data is hosted in Germany, and our Data Processing Agreement lists every subprocessor
As the controller, you sign our Data Processing Agreement, describe TWIPLA in your privacy policy and add it to your record of processing activities with a short legitimate-interest assessment.
Proof, not promises
How TWIPLA meets the GDPR
GDPR & ePrivacy statement
How TWIPLA handles data under both laws, from privacy modes to hosting, subprocessors and opt-outs.
Read the statementConsentless analytics, explained
Why TWIPLA can run on legitimate interest under Art. 6(1)(f) GDPR, with no consent needed.
Read the legal caseOur Data Processing Agreement
The Art. 28 GDPR agreement every TWIPLA customer signs, with all subprocessors listed.
Read the agreementWhat to put in your privacy policy
Ready-to-use wording for describing TWIPLA in your privacy policy.
Get the wordingTechnical University of Munich
How one of the world’s top universities runs GDPR-compliant analytics and sees 400% more of its traffic.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
