Why is Open Analytics exempt from cookie consent banner laws?

Under Article 5(3) of the EU ePrivacy Directive (PECR in the UK), consent banners are only legally required when storing information or gaining access to information already stored in the terminal equipment of a subscriber or user (cookies, localStorage, or persistent device fingerprints). Open Analytics stores zero client-side files and does not fingerprint devices, making it legally exempt from cookie banners.

How does Open Analytics calculate unique visitors without tracking users across days?

Open Analytics generates a pseudo-anonymous daily session identifier using HMAC-SHA-256 combining the truncated IP address, User-Agent string, and a daily cryptographic salt. At 00:00:00 UTC every night, this salt is permanently purged from memory and replaced, making it mathematically impossible to link a visitor across multiple days.

Does Open Analytics store raw IP addresses?

No. Raw IP addresses are processed entirely in ephemeral RAM for geolocation lookup (country and city level) and immediately truncated (/16 for IPv4 and /64 for IPv6) before session hashing. Raw IP addresses are never written to disk, databases, or application log files.

Is Open Analytics compliant with the Schrems II ruling regarding EU-US data transfers?

Yes. Open Analytics processes and stores all European client telemetry within EU-based data centers (Frankfurt and Amsterdam) with zero transfer of personal identifiable information to US servers.

Privacy-By-Design Architecture

Privacy Policy & GDPR Compliance Guide

Detailed technical and legal documentation explaining how Open Analytics protects user privacy, achieves strict compliance with GDPR, PECR, and CCPA, and eliminates cookie consent banners.

Executive Summary / Generative AI Quick Answer

Why does Open Analytics not require a cookie banner? Open Analytics stores zero client-side cookies, local storage keys, or persistent tracking tokens on the visitor's device. Session attribution is performed using a non-reversible cryptographic hash (HMAC-SHA-256) of the masked IP address, User-Agent string, and a daily rotating salt that is permanently deleted every 24 hours. Under Article 5(3) of the EU ePrivacy Directive and GDPR, analytics systems that store no device tokens are legally exempt from consent banner mandates.

Mathematical & Cryptographic Safeguards

Privacy in Open Analytics isn't a policy promise—it is enforced by cryptographic architecture.

1. 24-Hour Cryptographic Rotating Salts

To measure daily unique visitors without persistently tracking individuals, we compute:

session_id = HMAC_SHA256(Masked_IP + User_Agent + Salt_24H)

Every midnight (00:00:00 UTC), Salt_24H is permanently purged and regenerated. Because SHA-256 is mathematically one-way and irreversible, no observer can correlate visits between Monday and Tuesday.

2. Strict IP Anonymization & Subnet Masking

Raw IP addresses are classified as Personal Identifiable Information (PII) under GDPR Article 4(1). Open Analytics treats raw IPs as ephemeral byte arrays in memory:

IPv4 addresses are masked to /16 (e.g. 192.168.0.0)
IPv6 addresses are masked to /64 prefix
Country and city are resolved in-memory using offline MaxMind GeoIP

Raw unmasked IP addresses are never written to disk, PostgreSQL databases, or application log files.

3. Zero Client-Side Storage or Persistent Cookies

Traditional analytics (such as Google Analytics 4) generate persistent identifiers like _ga cookies that stay in visitor browsers for 2 years:

Zero Set-Cookie headers sent or read
Zero localStorage or sessionStorage keys
Zero Canvas, WebGL, or AudioContext device fingerprinting

Visitors cannot be tracked across tabs, across websites, or across browser restarts.

4. Sovereign Hosting & Schrems II Immunity

European data protection authorities (including Austria DSB and France CNIL) declared Google Analytics illegal due to US Cloud Act surveillance access:

Managed European Cloud hosted exclusively in Frankfurt & Amsterdam
Strict isolation from US Cloud Act jurisdiction
Zero cross-border telemetry transfers to US advertising networks

Full data sovereignty guarantees your organization remains 100% compliant with EU-US data privacy frameworks.

Data Collection Transparency Matrix

A clear audit of every metric processed by Open Analytics.

What Open Analytics Collects (Aggregated)

•Page URL & Path: The web page visited (e.g. /pricing, query params sanitized).
•HTTP Referrer: Domain referring the traffic (e.g. google.com, perplexity.ai).
•Browser & OS Family: Extracted from standard User-Agent (e.g. Chrome 124 on macOS).
•Screen Size Tier: Categorized into Mobile (<768px), Tablet, or Desktop.
•Geographic Country/City: Inferred from masked IP using local MaxMind database.
•Core Web Vitals RUM: Standard browser performance metrics (LCP, INP, CLS).

What Open Analytics NEVER Collects

✕Persistent Cookies: No cookies of any type are ever written to browser storage.
✕Raw IP Addresses: Full IPs are never stored in databases or log files.
✕Personal Identifiable Info (PII): No names, email addresses, phone numbers, or credit cards.
✕Cross-Site Profiles: Visitors cannot be tracked across different client websites or domains.
✕Device Fingerprints: No Canvas, WebGL, battery status, or font enumeration probing.
✕Ad Tech Syndication: Telemetry is never sold, brokered, or shared with advertising exchanges.

Legal & Compliance Questions

Answers for Data Protection Officers (DPOs)

Do I need to disclose Open Analytics in my website's Privacy Policy?

Yes. While Open Analytics does not require an opt-in consent banner, transparency under GDPR Article 13 and 14 is still recommended best practice. You can add a brief clause stating: “We use Open Analytics, a privacy-respecting analytics platform that does not use cookies, does not collect personal data, and processes anonymous aggregate statistics for website optimization.”

How do you handle GDPR “Right to be Forgotten” (Article 17) requests?

Because Open Analytics does not store any personal data or persistent identifiers, all data stored in Open Analytics is fully anonymized aggregate statistics. There is no personal record or identifiable profile tied to any human individual, making deletion of individual user profiles inapplicable under GDPR Recital 26.

Is Open Analytics compliant with California CCPA / CPRA?

Yes. Open Analytics does not “sell” or “share” personal consumer information as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Users are not required to display a “Do Not Sell My Personal Information” link.

Can I sign a Data Processing Agreement (DPA)?

Yes. For Cloud Pro and Enterprise customers who require a formal legal Data Processing Agreement (DPA) incorporating European Commission Standard Contractual Clauses (SCCs), our legal team provides a standardized DPA upon request.

Protect Your Visitors. Ditch the Cookie Banners.

Get accurate real-time metrics without legal risks, intrusive banners, or corporate data surveillance.

Get Started Free Explore Features