Cookies, GDPR and privacy-friendly analytics

Whether analytics needs a cookie banner depends on what it stores in the browser and what personal data it processes, and “cookieless” alone does not settle it. Website analytics sits right where two sets of rules meet: data protection law, which governs personal data, and the rules on storing information in a visitor’s browser. This guide explains both in plain terms, clears up a few common myths, and lists exactly what theBizness.ai does. It is general information, not legal advice; for your specific situation, ask a qualified lawyer or your data protection officer.

Two different rules

The GDPR applies to personal data: anything that relates to an identifiable person. In analytics that can include IP addresses, persistent visitor IDs and, obviously, names and email addresses. Processing personal data needs a lawful basis, such as consent or legitimate interest, and comes with duties around transparency, minimization and retention.

The ePrivacy rules (the EU ePrivacy Directive, and the UK’s PECR) are about the device itself. Storing information in a visitor’s browser, or reading it back, generally requires consent unless it is strictly necessary for a service the visitor asked for. Analytics is usually not considered strictly necessary, although some regulators, such as France’s CNIL, allow an exemption for narrowly configured audience measurement under specific conditions.

Outside Europe the picture differs again. California’s CCPA, for example, is built around notice and the right to opt out of the sale or sharing of personal information rather than prior consent.

Three myths

• “Cookieless means no consent needed.” The ePrivacy rules cover any storage on the device, not just cookies. localStorage, sessionStorage and similar techniques are treated the same way.
• “First-party cookies are always fine.” Being first-party reduces risk, because the data is not shared across sites, but it does not by itself remove the consent question.
• “Anonymous analytics is not personal data.” A persistent ID that recognizes the same browser over time is usually treated as personal data, even if you never learn the person’s name.

What makes analytics privacy-friendly

Whatever your legal basis, these practices lower risk and are worth looking for in any tool:

• No third-party cookies and no tracking of people across other websites.
• No sharing or selling of visitor data to advertisers.
• Collecting only what the reports need, and not storing IP addresses with events.
• Dropping query strings from URLs, where tokens, search terms and email addresses often hide.
• Automatic deletion of raw data after a fixed period.
• Keeping customer details out of the browser entirely.

Exactly what theBizness.ai stores

theBizness.ai is privacy-first, but it is not cookieless, and we would rather say so plainly. Revenue attribution needs to recognize a returning visitor, and that needs a first-party identifier. The script sets:

• thebizness_visitor_id: a first-party cookie with a visitor ID, kept for up to 365 days.
• thebizness_session_id: a first-party cookie with a session ID that expires one hour after the last tracked activity.
• thebizness_utm and thebizness_referrer_data in localStorage: the visit’s UTM tags and referrer, used for attribution for up to 30 days.

These are upper limits. Safari and Brave cap cookies written by JavaScript at about seven days, and Safari also clears localStorage after seven days without a visit. No third-party cookies are set.

On the server side:

• IP addresses are not stored with events. They are used only briefly as a rate-limit key: held in memory for about a minute, and as a keyed hash that expires within a day.
• Page and referrer addresses are stored without their query string.
• Besides the page, referrer and UTM tags, each pageview carries the screen width, page-load timing, your browser’s user agent and its time zone. Country comes from the time zone, so it is approximate; there is no IP geolocation and no city-level data.
• Known bots and automated browsers are skipped.
• Raw pageviews, custom events and conversion events are deleted automatically after 25 months.
• Customer emails are stored only when your server or payment processor sends them, and privacy mode masks names and emails in the dashboard during screen sharing.

What stays your decision

theBizness.ai is designed to help you meet your obligations under laws such as the GDPR and the CCPA, but it cannot meet them for you. As the website owner you decide whether you need consent before the script runs. If you do, load the script tag only after the visitor has accepted analytics in your consent banner (theBizness.ai does not ship a consent banner). Either way, describe the data collected, and these cookie and storage names, in your own privacy policy.

A short checklist: list the cookies and storage keys above in your policy, decide your lawful basis for each region you serve, gate the script behind consent where that basis is consent, and never send customer emails or other personal data from the browser. The privacy docs and our privacy policy have the full detail, and pricing covers the 14-day free trial.