> How the Ahoy Rails analytics gem handles first party cookies, consent and GDPR. A practical guide for European teams self hosting tracking.
>
> Canonical: https://www.flowconsent.com/en/services/analytics/ahoy

Analytics

# Ahoy

Analytics

Open source Ruby on Rails analytics gem for first party visit and event tracking, self hosted with data kept on the operator's own server.

[Block Ahoy until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [Analytics](https://www.flowconsent.com/en/services/analytics)

- Consent

  Analytics

- Prior consent

  Not required

- Documented cookies

  3

- Third-party domains

  2

- Servers

  Self hosted on the operator's own infrastructure

Overview

## What does Ahoy do?

## What Ahoy is

Ahoy is an open source analytics gem for Ruby on Rails that records visits and events directly in the operator's own application. It is first party by design and keeps the data inside the operator's database rather than sending it to an external vendor.

Because Ahoy is self hosted, the operator controls where the data lives, how long it is kept and who can access it. This architecture gives strong control over personal data compared with hosted third party analytics.

## What data and cookies it collects

Ahoy sets first party cookies named ahoy\_visit and ahoy\_visitor to group requests into visits and to recognise returning visitors. It records visit details such as landing page, referrer, and device and browser information, and any custom events the operator defines.

Ahoy can also store IP derived geolocation and a visitor identifier. These records are personal data under the GDPR, although Ahoy offers an anonymity set mode that avoids cookies and groups similar visitors instead.

## GDPR and ePrivacy implications

When Ahoy uses cookies it reads and writes information on the visitor's device, so the ePrivacy Directive applies. Where the cookies are treated as non essential, prior consent is required before they are set.

Under the GDPR the operator is the sole controller because no external processor is involved. The operator must still provide a privacy notice, define a lawful basis and apply a retention period to visit and event data.

## Consent requirements

If Ahoy is configured with cookies for analytics that are not strictly necessary, prior consent should be collected before the gem sets ahoy\_visit and ahoy\_visitor.

Ahoy can be configured without cookies using anonymity sets, which can reduce or remove the consent requirement in some jurisdictions where the measurement is strictly limited. Confirm the local interpretation before relying on an exemption.

## International data transfers

Ahoy stores data on the operator's own infrastructure, so there is no transfer to a third party vendor. The transfer position depends entirely on where the operator hosts its servers.

If the operator hosts within the European Economic Area, no international transfer occurs. If hosting is outside the area, the operator must put an appropriate transfer mechanism in place.

## Practical compliance steps

Decide whether to run Ahoy with cookies or with anonymity sets, set a clear retention period for visits and events, and add the processing to your records.

If cookies are used, gate them behind consent and document ahoy\_visit and ahoy\_visitor in your cookie policy. Consider masking or truncating IP addresses and limiting the events you collect to what you genuinely need.

Compliance

## Ahoy and the GDPR

- Legal basis

  Legitimate interest for first party measurement where data stays on the operator's server, with consent recommended where local rules treat the analytics cookies as non essential

- Risk level

  low

- Applicable regulations

  GDPR, ePrivacy Directive

### Impact assessment (DPIA)

Ahoy keeps data on the operator's own server, which lowers risk, but a DPIA may still be warranted where event tracking is extensive or combined with account data. Assess retention of visit and visitor records, IP and geolocation storage, and whether anonymity sets are used instead of cookies, then document minimisation measures.

### Sample text for your banner

> We use Ahoy, a first party analytics tool hosted on our own servers, to understand how visitors use this site. With your consent, Ahoy sets first party cookies to count visits and events. You can accept or decline these analytics cookies at any time.

Cookies and trackers

## What Ahoy sets and contacts

- Tracking method

  First party server side and JavaScript tracking with first party cookies

- Server location

  Self hosted on the operator's own infrastructure

- Cookieless mode available

  Yes

### Cookies set (3)

| Name          | Type        | Duration | Purpose                                                                  |
| ------------- | ----------- | -------- | ------------------------------------------------------------------------ |
| ahoy\_visit   | First party | 4 hours  | Identifies the current visit and groups events into a single session     |
| ahoy\_visitor | First party | 2 years  | Recognises the returning visitor across visits for first party analytics |
| ahoy\_track   | First party | Session  | Buffers events client side before they are sent to the operator's server |

### Third-party domains contacted (2)

- `The operator's own website domain`
- `The operator's own Rails application domain`

Questions

## Frequently asked questions about Ahoy

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Which cookies does Ahoy set?

By default Ahoy sets two first party cookies, ahoy\_visit and ahoy\_visitor. The visit cookie groups requests into a single visit and the visitor cookie recognises a returning visitor. Ahoy can also run without cookies using anonymity sets, in which case no analytics cookies are stored.

### Is consent required for Ahoy?

If Ahoy uses its cookies for non essential analytics, prior consent is generally required under the ePrivacy Directive. If you configure Ahoy with anonymity sets and avoid cookies, the consent requirement may be reduced or removed in some jurisdictions, subject to local interpretation.

### What is the legal basis for processing with Ahoy?

Because data stays on your own server, many operators rely on legitimate interest for first party measurement, with a balancing test recorded. Where the cookies are treated as non essential, consent under the ePrivacy Directive is needed to set them. Document the basis you choose.

### Does Ahoy transfer data outside the EU, to the US in particular?

Ahoy itself does not transfer data to any vendor because it is self hosted. Whether data leaves the EU depends on where you host your application. If your servers are in the European Economic Area, no international transfer occurs.

### Is a DPIA needed for Ahoy?

Often not, because the risk is lower when data stays on your own server. A DPIA becomes advisable where event tracking is extensive, combined with account data, or stores precise geolocation. Assess scope and retention and document the outcome.

### How do I implement Ahoy compliantly?

Choose between cookies and anonymity sets, set a retention period, and limit the events you record. If using cookies, gate them behind consent and list ahoy\_visit and ahoy\_visitor in your cookie policy. Consider masking IP addresses to minimise data.

### What are the alternatives to Ahoy?

Alternatives include other self hosted analytics tools and privacy focused platforms that offer cookieless measurement. For Rails teams Ahoy is attractive because the data stays in your own database, but lighter aggregate tools may suit simpler needs.

### How do I update the cookie policy for Ahoy?

If you run Ahoy with cookies, list ahoy\_visit and ahoy\_visitor with their purpose and duration and state that they are first party analytics cookies. If you run anonymity sets, you can state that no analytics cookies are used. Keep the policy in step with your configuration.

Same category

## More services: Analytics

[See the whole category](https://www.flowconsent.com/en/services/analytics)

### [Sitefinity Insight](https://www.flowconsent.com/en/services/analytics/sitefinity-insight)

[Sitefinity Insight is a web analytics platform that provides businesses with actionable insights into website traffic, user behavior, and conversion performance. It offers real-time data collection, customizable dashboards, and advanced reporting to help organizations understand their audience. Sitefinity Insight supports event tracking, funnel analysis, and audience segmentation, enabling data-driven decision making that improves user experience and drives business growth across digital channels.](https://www.flowconsent.com/en/services/analytics/sitefinity-insight)

[Analytics](https://www.flowconsent.com/en/services/analytics/sitefinity-insight)

·

### [Marchex](https://www.flowconsent.com/en/services/analytics/marchex)

[Marchex is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Marchex offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Marchex empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/marchex)

[Analytics](https://www.flowconsent.com/en/services/analytics/marchex)

·

### [FullContact](https://www.flowconsent.com/en/services/analytics/fullcontact)

[FullContact is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. FullContact offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, FullContact empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/fullcontact)

[Analytics](https://www.flowconsent.com/en/services/analytics/fullcontact)

·

### [CallRoot](https://www.flowconsent.com/en/services/analytics/callroot)

[CallRoot is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. CallRoot offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, CallRoot empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/callroot)

[Analytics](https://www.flowconsent.com/en/services/analytics/callroot)

·

### [Pulse Insights](https://www.flowconsent.com/en/services/analytics/pulse-insights)

[Pulse Insights is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Pulse Insights offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Pulse Insights empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/pulse-insights)

[Analytics](https://www.flowconsent.com/en/services/analytics/pulse-insights)

·

### [ExactVisitor](https://www.flowconsent.com/en/services/analytics/exactvisitor)

[ExactVisitor is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. ExactVisitor supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, ExactVisitor enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/exactvisitor)

[Analytics](https://www.flowconsent.com/en/services/analytics/exactvisitor)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)