Module 8 · 8.1

English

Nederlands English Deutsch

Measuring with privacy-friendly analytics

Module 8: Measuring, pitfalls and maintenance · Reading time: 12 minutes

Learning objective: After this lesson you can measure visits to your site without collecting unnecessary data, explain when you need consent for analytics cookies, and describe the difference between Search Console and an analytics tool.

Key concepts: analytics (web statistics), server statistics (AWStats, access log), tracking script, Matomo, Plausible, Google Analytics, limited analytics cookies, consent, Article 11.7a of the Dutch Telecommunications Act, legitimate interest, shortening IP addresses, Search Console versus analytics, goal (conversion), measurement plan

Why measure?

In the previous modules you improved a lot: titles, speed, structured data, your business profile. But does it pay off? You only know if you measure. Measuring answers three questions:

Are people coming? How many visitors, on which pages.
Where do they come from? Via Google, via Bing, via a link on another site, via your business profile, or directly.
Do they do what you hope? Request a quote, call you, place an order. Such a desired action is called a goal (in marketing language: a conversion).

Measuring is not a goal in itself. If you look at a hundred charts and change nothing, measuring does you no good. So choose a few questions in advance and only measure what you need to answer them. That is also exactly what privacy law asks of you.

Two sources that complement each other

Search Console: what happens in Google

Search Console (lesson 2.3) shows what happens in Google, before someone reaches your site: how often your page appeared in the results (impressions), how often it was clicked (clicks) and for which searches. Google counts a click when someone goes from the search results to your page. Search Console knows nothing about what the visitor does on your site afterwards, and nothing about visitors who come via Bing, a link or your newsletter. For Bing you have Bing Webmaster Tools.

An analytics tool: what happens on your site

An analytics tool measures what happens on your site: which pages are visited, for how long, from which source, and whether someone reaches a goal. There are three kinds:

Kind	How it works	Examples
Server statistics	The web server writes every request to a log; a program turns that into tables. No script in your page, no cookie	AWStats in DirectAdmin, the access log
A tracking script you host yourself	A piece of JavaScript in your page sends every visit to your own analytics server	Matomo (self-installed)
A tracking script from a service	The script sends the visit to the service's server	Google Analytics, Plausible, Fathom, Simple Analytics, Matomo Cloud

There are also tools that are not ordinary analytics but do record behaviour, such as Microsoft Clarity and Hotjar (recordings of mouse movements and clicks) and the Meta Pixel (for advertising on Facebook and Instagram). These go much further than "counting visitors".

Server statistics also count bots and crawlers and are not good at seeing which visitor views which pages in sequence. A tracking script sees that better, but misses visitors who block scripts. No single source is complete. So look at trends (is it going up or down?) rather than the exact number. Differences between Search Console and your analytics tool are normal.

Cookies, consent and the law

Many tracking scripts place a cookie or read something from the visitor's browser. In the Netherlands this is covered by Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet), the Dutch cookie rule. This rule comes from EU law (the ePrivacy Directive); other EU countries have their own implementation and their own regulator. The main rule: to store or read information on a visitor's device you need consent, and you must clearly explain what it is for.

Paragraph 3 of that article makes a few exceptions. One of them: no consent is needed for information about the quality or effectiveness of your website, provided this has no or minor consequences for the privacy of the visitor. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) calls these limited analytics cookies: cookies that, for example, count the number of visitors and the most visited pages so that you can improve your site. That does not release you from everything:

If those cookies process personal data (an IP address is already personal data), the GDPR applies too. You then need a legal basis; according to the AP, for functional and limited analytics cookies that can be a legitimate interest, after weighing it against the interests of the visitor.
You mention the measuring in your privacy statement, and visitors must be able to object easily.
As soon as data is used to follow visitors across sites, to build profiles or for advertising, they are tracking cookies and you do need consent.

Google Analytics

According to the AP, with Google Analytics you process your visitors' personal data. The AP used to publish a guide for setting up Google Analytics in a privacy-friendly way, but it covered the old version (Universal Analytics). Whether the current Google Analytics 4 can be used without consent is not easy to say and depends on your settings, such as data sharing with Google and the link with advertising. The safe choice for a small site: if you use Google Analytics, ask for consent. If you are unsure about your own situation, check the AP's cookie pages. This lesson is not legal advice.

Privacy-friendly measuring in practice

If you want to measure without a cookie banner and without hassle, choose something that collects as little as possible:

Server statistics you already have. At WebOké you find them in DirectAdmin under Site Summary / Statistics / Logs (AWStats). Other hosting companies call it something else, but almost every hosting package has something similar.
Hosting Matomo yourself. You install it on your own hosting package (at WebOké via Installatron or the Websitemanager; elsewhere often via a similar installer). The data then stays with you. Matomo can measure without cookies (_paq.push(['disableCookies']); before trackPageView) and has a setting to shorten IP addresses (Administration, Privacy, Anonymize data).
A service that says it works without cookies, such as Plausible. Plausible states in its privacy policy that it uses no cookies and stores no IP addresses, and counts unique visitors with a code that changes every 24 hours. For every service, read the privacy policy yourself and check where the data is stored.

A few rules of thumb, whichever tool you choose:

Only measure what you need for your questions.
Shorten IP addresses or don't store them.
Don't share data with the supplier for its own purposes, and don't link analytics to advertising without consent.
Don't keep data longer than necessary (for example 13 or 25 months; choose yourself and write it down).
Put it in your privacy statement.

Watch out for multiple scripts

A common situation: a web designer once put Google Analytics on the site, later a Meta Pixel was added and a plugin added Hotjar. Nobody looks at them any more, but the scripts send data away every day and make your site slower. So know exactly what runs on your site. Exercise A8.1 helps with that.

Note: many sites load their tracking scripts via Google Tag Manager. In the HTML you then only see Tag Manager (googletagmanager.com/gtm.js), not which scripts Tag Manager loads afterwards. You only see that in the settings of Tag Manager itself, or in the network tab of your browser's developer tools.

A measurement plan in five lines

A measurement plan doesn't have to be big. Bloemenatelier Lotte writes:

Question 1: are more people reaching the bridal bouquet page via Google?   Source: Search Console, page filter, per month
Question 2: how many quote requests come in via the site?                  Source: Matomo, goal "form submitted"
Question 3: how many people click "Route" or "Call" in Google?            Source: performance in the Business Profile
Tool: Matomo on own hosting, without cookies, IP shortened by 2 bytes, kept for 25 months
Rhythm: first Monday of the month, 20 minutes of looking and noting one action

The rhythm is the most important part. Looking once a month and improving one thing achieves more than staring at a counter every day.

In practice: measuring on your own site

With a WebOké hosting package, the server statistics are in DirectAdmin; you install Matomo in a few clicks. A site from the AI Builder or WordPress can also get an external tracking script; only do that if you know what it collects. Other providers work in a similar way: server statistics in the hosting panel, and an installer for Matomo or a plugin for another service.

Summary

Search Console measures what happens in Google, an analytics tool what happens on your site. Differences are normal; look at trends.
Under the Dutch Telecommunications Act (Article 11.7a) you don't need consent for limited analytics cookies with no or minor privacy consequences; for tracking cookies you do. The GDPR still applies.
Google Analytics processes personal data; if in doubt, ask for consent. Server statistics, self-hosted Matomo or a cookieless service are privacy-friendly choices.
Know which scripts run on your site; via Tag Manager you don't see them in the HTML.
Make a measurement plan: a few questions, the source per question, and a fixed rhythm.

Quiz

Exercise

Exercise A8.1: Which tracking runs on your site? Enter your site's address and choose which analytics and tracking services you think run on it. The program reads the HTML of your homepage and shows the services it recognises next to your choice. No site of your own? Use a site from the exercise.

Exercise D8.1: Your measurement plan. Write a measurement plan like Bloemenatelier Lotte's: two or three questions, the source for each question, the tool with its privacy settings, and a fixed rhythm.

Exercise D8.1: Your measurement plan

You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.

Two or three questions written down
A source for each question
Tool chosen
Privacy settings noted (cookies, IP anonymisation, retention period, sharing)
Mentioned in your privacy statement, or noted as a to-do
Rhythm in your calendar

Your measurement plan

Which scripts from A8.1 do you remove or put behind consent, and why?

What struck you about the difference between Search Console and your analytics tool?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing