First, know what counts as personal data
GDPR's definition is wider than most people assume: any information relating to an identified or identifiable person. For analytics that includes IP addresses, cookie identifiers, device fingerprints, and user IDs -- even pseudonymised ones, since a hashed identifier that could be matched back is still personal data. Truly anonymised, aggregated statistics ("1,400 visits from Germany this week") fall outside the regulation.
This is the fork in the road. Cookie-based tools like GA4 process personal data by design, so they carry the full compliance load. Anonymous tools carry almost none of it. Every item below is marked accordingly.
The checklist
1. Inventory what actually runs on your site
Open your pages with browser DevTools and list every third-party request: analytics, pixels, heatmaps, embedded widgets, fonts, chat bubbles. Compliance work fails most often on the tracker somebody added in 2022 and forgot. You cannot be compliant about scripts you do not know you have.
2. Determine the legal basis for each tool (personal-data tools)
For analytics cookies the realistic basis is consent -- EU regulators have consistently rejected "legitimate interest" for tracking-based analytics. That means prior, informed, freely-given consent: no pre-ticked boxes, no cookies before the answer, and declining must be as easy as accepting.
3. Get the consent banner right (personal-data tools)
If a banner is required, the common failure modes are: scripts firing before consent (test it -- watch the network tab on a fresh browser), a decline option hidden behind "manage preferences", and consent records not being stored. Expect the honest version to cost you 20-40% of your measured traffic, because that is how many visitors decline.
4. Configure the tool defensively (personal-data tools)
IP anonymisation on, advertising and demographics features off unless separately consented, data retention set to the minimum you use, and no user IDs or form data leaking into analytics events. Each Google "signal" you enable widens the processing you must justify.
5. Check international transfers (personal-data tools)
US-owned tools currently rely on the EU-US Data Privacy Framework. That framework is under legal challenge, and its predecessors were both struck down -- the history is in is Google Analytics illegal in Europe. EU-hosted tools remove the question. Know which side each of your tools sits on.
6. Paper the processing
A data processing agreement (DPA) with each analytics provider, the tool listed in your privacy policy (what is collected, why, retention, transfers), and -- for personal-data tools -- an entry in your records of processing. Anonymous tools still deserve a privacy-policy mention for transparency, but the paperwork shrinks to a paragraph.
7. Honour the data-subject rights you have created (personal-data tools)
Collecting personal data means being able to answer access and deletion requests about it. With aggregated anonymous data there is nothing to retrieve or delete -- another line of operational burden that simply disappears.
8. Re-audit twice a year
Sites accrete scripts. A calendar reminder and ten minutes in DevTools keeps the inventory honest -- and catches the marketing plugin update that quietly added a pixel.
The shortcut: make most of the list unnecessary
Read back through the items marked personal-data tools: consent banner mechanics, defensive configuration, transfer analysis, data-subject requests. All of it exists because the tool collects personal data. Choose analytics that does not -- no cookies, no identifiers, IPs discarded at ingestion, aggregated output only -- and the checklist collapses to: inventory, a DPA, a privacy-policy paragraph, and the semi-annual re-audit.
That is the design principle behind privacy-first analytics and behind TrackTrendy specifically: complete visitor, source, campaign, goal and revenue reporting with no personal data in the system, from €4/month. Compliance by architecture rather than by paperwork -- with the side effect that you measure 100% of your visitors instead of the consenting fraction.
One honest caveat: cookieless analytics covers the analytics row of your inventory. If you also run advertising pixels, newsletters, or accounts, those remain personal-data processing with their own compliance requirements. The win is removing the row that touches every single visitor on every single page.