Privacy analytics has become a genuine operational concern for organisations that handle medical information. A laboratory publishing reference ranges for blood tests, a research institute sharing study data, or a hospital network running a patient-information portal — each of these attracts a specific kind of visitor: someone who is anxious, often unwell, and whose browsing behaviour carries far more sensitivity than it would on a retail or entertainment site.
The question of how to measure that traffic responsibly sits at the intersection of data protection law and basic ethics. For anyone working in this space, Librealytics covers the privacy-respecting analytics landscape in depth — what the tools actually do, how they differ from conventional tracking, and what genuinely GDPR-compliant setup looks like in practice. On the legal and advocacy side, the Electronic Frontier Foundation documents how digital privacy rights apply to health contexts and beyond.
What "privacy analytics" actually means for health-adjacent sites
The term privacy analytics describes a category of measurement approaches designed to collect only the data required to understand audience behaviour — without storing personally identifiable information, without dropping persistent identifiers on the visitor's device, and without routing that data through third-party advertising infrastructure.
For a site that publishes medical reference content, this distinction is not purely theoretical. Standard analytics platforms — the ones most organisations installed by default over the past decade — record IP addresses, build cross-site behavioural profiles via third-party cookies, and send raw event data to servers outside the organisation's control. When those events include page titles like "Stage 3 kidney disease prognosis" or "glucose tolerance test preparation," the combination becomes sensitive data under most interpretations of GDPR Article 9, which covers special-category health information.
Privacy analytics addresses this by design rather than by configuration. The tracking is cookieless from the start, IP addresses are either dropped entirely or hashed before storage, and the resulting data — session counts, referral sources, popular pages — stays aggregated rather than individual. What you lose is the ability to build per-user journey maps. What you gain is a defensible measurement setup that doesn't require a lengthy consent dialogue before someone can read about their test results.
Anonymous, cookieless tracking means visitor behaviour on a patient-facing site stays aggregated — no personal health inference is possible from the measurement data.
Why GDPR-compliant analytics matters in laboratory and research settings
GDPR places specific obligations on organisations that operate websites, regardless of whether those sites are commercial. A university research institute or a publicly funded diagnostics lab is as liable under the regulation as a private healthcare provider. The relevant obligations cluster around two questions: what data is collected, and where does it go?
The first question is answered by the analytics tool's architecture. GDPR-compliant analytics, properly implemented, collects only the metrics needed to understand usage patterns — no persistent identifiers, no cross-session tracking, no device fingerprinting. Several tools accomplish this through server-side aggregation: the raw request arrives at the server, a visit count is incremented, and the request is discarded. The visitor's IP address is never written to disk.
The second question concerns data residency. Sending visitor data to any server outside the European Economic Area triggers GDPR's international transfer rules, which require either adequacy decisions or appropriate safeguards. This is one reason the research community has shown consistent interest in self-hosted and open source web analytics: hosting the analytics service on the same infrastructure as the site itself keeps data within the organisation's own legal jurisdiction and removes the third-party processor entirely from the chain.
That combination — no personal data collected, no third-party transfer — is what allows some GDPR analytics implementations to operate without a cookie consent banner. The legal basis for processing is no longer required, because the processing that triggers consent obligations simply does not occur.
GDPR-compliant analytics dashboard for a research site: aggregated metrics with no individual-level rows, no persistent IDs, and no third-party data transfer.
What does anonymous web analytics look like in practice?
Anonymous web analytics, for organisations that need to understand their content performance without compromising visitor confidentiality, works through a small number of consistent design choices.
Cookieless counting. Instead of assigning each visitor a persistent cookie-based ID, the tool derives a temporary session identifier from hashed combinations of request characteristics — user agent, screen resolution, a daily rotating salt. This identifier cannot be linked back to an individual across sessions or across sites. The visitor is not tracked; the visit is counted.
Server-side aggregation. The raw HTTP request is processed on the server, counts are updated in the analytics database, and the request is dropped. Nothing is sent to a browser-side script. This also avoids the performance cost of loading a third-party tag and the blocking behaviour that client-side consent checks can introduce.
Open-source transparency. Several of the tools used in this category — Plausible Analytics, Umami, GoatCounter, Matomo in first-party mode — publish their source code under open licences. For a research institution with a security review requirement, being able to read the collection script before it runs on your infrastructure is not a minor benefit. It is the difference between trusting a vendor's privacy statement and verifying it.
Data stays in-house. Self-hosting the analytics service means the aggregated counts — page views, bounce rates, top referrers — live in a database the organisation controls. There is no vendor API to call, no export to rely on, no dependency on a third party's pricing decisions or terms-of-service changes.
For organisations measuring patient-facing or research-oriented content, this architecture answers the core compliance question before legal review even begins: what personal data does this system process? The answer, when these tools are correctly configured, is: none.
How open-source web analytics tools fit into health and research infrastructure
The practical case for open source web analytics in institutional settings comes down to auditability and sovereignty. Proprietary analytics platforms, even privacy-marketed ones, are black boxes. The organisation cannot independently confirm what the collection script does, cannot audit the data pipeline, and cannot prevent the vendor from changing its behaviour through a silent update.
Open source tools invert that relationship. The code is public. The data model is documented. The organisation's technical team can review the implementation, apply patches, and know exactly what is stored. For a research body that publishes peer-reviewed data and is accountable to an ethics committee, that auditability is not optional.
There are practical considerations alongside the principled ones. Self-hosting requires someone to run the service — deploy the container, apply updates, back up the database. For a small laboratory team, that overhead matters. Cloud-managed versions of open source tools (Plausible Cloud, Fathom, a managed Matomo) offer a middle path: the vendor handles infrastructure, but the data model remains privacy-respecting and the code is auditable.
The choice between self-hosted and managed typically turns on two things: whether the organisation's security requirements demand on-premises data, and whether the internal team has capacity to operate a service. Research institutes with existing server infrastructure often find that adding an analytics container to an existing stack is straightforward. Smaller diagnostic labs may prefer managed options that reduce operational burden while still meeting GDPR's data transfer requirements through EU-based hosting.
