Privacy laws are everywhere now. GDPR in Europe, CCPA in California, HIPAA for US healthcare, PECR in the UK, and the list keeps growing. If you run a website or app, you've probably asked yourself: "Is my analytics setup OK under all this?"
The good news: analytics compliance doesn't have to be hard or expensive. The bad news: many popular analytics tools make it harder than it needs to be.
This guide explains what the main laws mean for your analytics, and how cookie-free tracking, no stored IP addresses and EU-only hosting can make the work simpler. It also shows where Pieowl fits.
This guide is general information, not legal advice. Laws and rulings change. Check your own setup with a privacy lawyer.
Why analytics compliance matters
When someone visits your site, you collect data about them: maybe their location, the pages they viewed, how long they stayed, or the buttons they clicked. Under many privacy laws, some of this counts as personal data.
Getting it wrong costs real money. GDPR fines can reach €20 million or 4% of global yearly turnover, whichever is higher. Under the CCPA, fines are up to $2,663 per violation and $7,988 per intentional violation (amounts in effect since January 2025). On top of fines, you risk your reputation and your users' trust.
Most analytics problems come down to three things.
Sharing data with a third party. With Google Analytics and similar tools, your visitors' data flows through the vendor's servers. You're still responsible for that data, even on someone else's machines.
Cookies and consent. Many analytics tools rely on cookies. In the EU and UK, you usually need consent before you store non-essential cookies on someone's device. That means cookie banners, consent tools and lost data from people who say no.
Sending data abroad. If you collect data from people in the EU and it ends up on US servers, you need a legal basis for that transfer. This is why several EU regulators ruled against specific Google Analytics setups in 2022.
You can avoid much of this. Use a cookie-free analytics tool that keeps as little personal data as possible, and store the data in the EU if your visitors are in the EU.
GDPR: the one everyone knows
The General Data Protection Regulation applies to any organization that handles personal data of people in the EU, wherever the organization is based. So if you have visitors from Europe, GDPR likely applies to you.
What GDPR asks of your analytics
A lawful basis. You need a legal reason to process personal data. For analytics, that's usually consent or "legitimate interest." Consent is clearer but needs a banner. Legitimate interest is possible, but you must document it and weigh it against your visitors' rights.
Data minimization. Collect only what you need. If you track 50 user properties but only look at 5, that's a problem.
Right to erasure. People can ask you to delete their data. You need to be able to do that, which is harder when the data sits in a vendor's database.
Transparency. People need to know what you collect and why. That means a clear privacy policy.
The Google Analytics rulings
In 2022, data protection authorities in Austria, France and Italy found specific uses of Google Analytics unlawful. The core issue was personal data, including IP addresses, going to the US, where US authorities could access it. That breaks GDPR's rules on international transfers (Chapter V).
In July 2023, the EU adopted the EU-US Data Privacy Framework, a new legal basis for sending data to US companies that sign up to it. That changed the picture, but these rules have been overturned before. Many teams prefer to keep EU data stored in the EU, so less depends on these rules.
How Pieowl handles GDPR
Pieowl is built for GDPR: no cookies, no stored IPs.
No cookies. The Pieowl tracker never sets a cookie and stores nothing on your visitors' devices, so in many cases you don't need a consent banner for analytics. EU rules can still apply without cookies, and they differ by country. See Do you need a cookie banner? and our cookie-free analytics guide.
No stored IP addresses. Pieowl uses the IP address only to look up the country and to build a visitor hash, then drops it. The hash mixes the browser, the IP, the site and a secret salt that changes every day, so anonymous visitors can't be followed from one day to the next.
Your data stays in the EU. Pieowl Cloud stores all your analytics and account data there.
Export and delete. Export raw events through the export API, or send them to S3 or Google Cloud Storage. Team admins can delete a whole site and its data from the dashboard.
CCPA: California's privacy law
The California Consumer Privacy Act, as amended by the CPRA, gives California residents rights over their personal information. If you do business in California or collect data from people there, it may apply to you.
Key CCPA rights
Right to know. People can ask what personal information you've collected about them, where it came from and who you shared it with.
Right to delete. Like GDPR, people can ask you to delete their personal information.
Right to opt out. This is the big one for analytics. People can opt out of the "sale" or "sharing" of their personal information. Under the CCPA, "sharing" includes giving data to third parties for cross-context behavioral advertising.
No discrimination. You can't treat people worse because they used their privacy rights.
The "Do Not Sell or Share" problem
Some analytics and ad tools can use the data they collect for their own purposes. Depending on the setup, that may count as a "sale" or "sharing" under the CCPA. Then you must honor "Do Not Sell or Share" requests, track opt-outs and pass them on to every vendor involved. That's real ongoing work.
Pieowl and the CCPA
Pieowl Cloud is a vendor that receives your visitors' data, so list it in your privacy notice like any other service you use. What helps is how little it keeps: Pieowl sets no cookies and doesn't store IP addresses. Less personal information means less to explain and less to handle when someone sends a request. You still need a way to handle those requests.
HIPAA: special rules for health data
If you work in US healthcare or handle Protected Health Information (PHI), HIPAA adds another layer. This is where analytics can get expensive.
The BAA requirement
HIPAA requires a Business Associate Agreement (BAA) with any vendor that creates, receives or stores PHI for you. A BAA is a contract that sets out what the vendor may and may not do with health information.
Many analytics vendors don't sign BAAs, or only on higher plans. Some do: Amplitude and PostHog both mention BAAs on their own sites (checked October 2026). Always check the plan and the price before you send health data anywhere.
What can count as PHI in analytics
PHI isn't just medical records. An IP address or a user ID, linked to the fact that someone used a health service, can be PHI. That is why tracking on patient portals and other logged-in health pages needs extra care. HHS has published guidance on tracking technologies on healthcare websites, and parts of it have been challenged in court. Read the current version with your counsel.
Pieowl and HIPAA
Pieowl has no self-hosted option. If you use it, Pieowl Cloud is your analytics vendor, so the BAA rule above applies. If you're thinking about Pieowl for health data, contact us at hello@pieowl.com before you send any.
PECR: the UK's cookie law
If you have visitors in the UK, think about PECR (the Privacy and Electronic Communications Regulations) next to UK GDPR. PECR covers cookies and similar technologies.
What PECR asks
PECR's rule is simple but strict: you need consent before you store information on someone's device, or read information from it, unless an exemption applies. The UK regulator, the ICO, says this covers storage "by any method," not just cookies.
The classic exemptions cover what is strictly necessary to send a communication or to provide a service the user asked for. For years, analytics cookies did not fit, so they needed consent.
What changed in 2025 and 2026
The Data (Use and Access) Act 2025 changed PECR in two ways that matter here. It raised the maximum PECR fine to the UK GDPR level: up to £17.5 million or 4% of global turnover. It also added narrow exemptions from consent, including for some analytics. Those exemptions come with strict conditions, such as giving people a clear way to opt out. Read the ICO's latest guidance before you rely on them.
Where Pieowl fits
Pieowl's tracker sets no cookies and stores nothing on the visitor's device. But PECR covers reading information from a device too, and the script does read things like the page address and referrer.
UK GDPR still applies to any personal data you process, and PECR covers more than cookies. So ask your lawyer how PECR applies to your exact setup, and whether the new analytics exemption covers it. A cookie-free tool at least takes cookies out of the question.
How Pieowl keeps it simpler
Three things come up in every section above: cookies, personal data and where the data is stored. Pieowl keeps each one small: it sets no cookies, doesn't store IP addresses, and stores your data in the EU.
How it helps with each law
GDPR: No cookies, no stored IPs, and EU storage if you want it. You can export raw events, or delete a whole site and its data.
CCPA: Less personal information to disclose and to handle requests for. Pieowl is still a vendor, so list it in your privacy notice.
HIPAA: No shortcut here. A cloud analytics vendor that receives PHI needs a BAA, so contact us before you send any health data.
PECR: No cookies and very little device storage, so cookies are out of the question for your analytics.
Pieowl has no self-hosted option. If your rules say analytics data must stay on servers you run yourself, Pieowl is not the right fit.
The hidden cost of "free" analytics
Take Google Analytics. It's free to use, but it can bring compliance costs that many teams don't plan for.
Consent management. You may need a consent tool, keep it up to date, and accept gaps in your data from people who decline.
Legal review. Your lawyers need to understand how the tool handles data and keep your privacy documents current.
Vendor reviews. In regulated industries, you need to keep checking the vendor's practices.
Transfer risk. Rules on sending EU data to the US have changed several times, and they may change again.
Deletion requests. Handling a person's deletion request inside a third-party tool can be slow.
Add these up, and "free" analytics often isn't free. A cookie-free tool with clear pricing can work out cheaper and simpler.
Other laws worth knowing
GDPR, CCPA, HIPAA and PECR are the big ones, but your audience may bring others:
LGPD (Brazil): Similar to GDPR, with rules on legal basis, data minimization and user rights.
PIPEDA (Canada): Requires consent to collect and use personal information, with some exceptions.
US state laws: A growing number of US states have their own privacy laws. Many follow patterns similar to the CCPA.
If your setup works under GDPR and CCPA, you're usually in good shape for many of these. Cookie-free analytics that stores no IP addresses puts you ahead on most of them. Still, check each one that applies to you.
Getting started
Pieowl runs in our cloud. We run the servers, and your data is stored in the EU. You can try it free for 14 days without a card. After that, plans start at $9 a month for 10K events.
You get cookie-free tracking, funnels, retention, user profiles, session replay and an MCP server for your AI assistant.
Does Pieowl use cookies?
No. The Pieowl tracker never sets a cookie, and it stores nothing on your visitors' devices.
Is Pieowl GDPR compliant?
Pieowl is built for GDPR: no cookies, no stored IPs, and data stored in the EU. Compliance also depends on how you use it, such as what you track and what your privacy policy says, so check your setup with your lawyer.
Do I need a BAA to use Pieowl for healthcare analytics?
Pieowl has no self-hosted option, so Pieowl Cloud would be your analytics vendor. HIPAA requires a BAA with any vendor that stores PHI for you. If you're thinking about Pieowl for health data, contact us at hello@pieowl.com before you send any.
Can I use Pieowl without a cookie banner?
Often, yes, for analytics. Pieowl sets no cookies and stores nothing on your visitors' devices, so in many cases you don't need a consent banner for it. But some countries, like Germany, Poland and Ireland, have no exemption for analytics, and session replay needs consent everywhere. You still need a privacy policy that explains what you collect, and other tools on your site may still need consent. See Do you need a cookie banner?.
Where is Pieowl Cloud data stored?
In the EU.
Can I self-host Pieowl?
No. Pieowl is cloud only, with your data stored in the EU.
Can I switch from Google Analytics to Pieowl?
Yes, for most uses. Pieowl covers web analytics and product analytics in one place. Pieowl can't import Google Analytics history, so you start fresh. Many teams run both side by side for a while. See the Google Analytics alternative page.
Can I check how my data is handled?
Yes. The privacy section above explains what Pieowl collects and what it doesn't.