Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Ahrefs Analytics (Ahrefs Web Analytics) is the cookieless, privacy first audience measurement product from Ahrefs Pte. Ltd. (Singapore). A single first party snippet posts aggregated page views and referrer data to AWS EU regions and never writes cookies or localStorage on the visitor's device. Under the conditions set by the CNIL, AEPD and other EU regulators, Ahrefs Analytics can usually be deployed without a cookie consent banner, but the international transfer to Singapore must still be documented.
Ahrefs Analytics, sometimes called Ahrefs Web Analytics, is a free privacy first audience measurement product from Ahrefs Pte. Ltd., a Singapore based SEO and marketing intelligence company. It is the company''s answer to Google Analytics 4 and to other privacy focused tools such as Plausible, Fathom and Simple Analytics. A single first party JavaScript snippet, around 1 KB, is loaded from analytics.ahrefs.com on every page and reports basic visit metrics directly to the Ahrefs backend.
The product was designed to be cookieless and to give publishers a way to run analytics without a cookie banner under EU rules. It exposes traffic, top pages, top referrers, devices, countries and basic conversion goals, but does not provide individual user identifiers, cross site tracking or remarketing audiences.
For each page view, the Ahrefs snippet sends the URL, the document title, the referrer, the screen size, the language, the user agent string and the IP address of the visitor. On the server side, the IP and user agent are combined with a daily rotating salt to derive a short hash that allows session and unique visit counting for one day, after which the hash can no longer be recomputed. No cookies, no localStorage, no IndexedDB and no fingerprinting are written on the visitor''s device.
EU traffic is processed and stored on AWS Frankfurt (eu central 1) and Dublin (eu west 1). Aggregated reporting data is retained while the property is active; the raw, hashed event data is kept for a limited window for analytics computation.
Because Ahrefs Analytics never writes anything on the visitor''s device, Art. 5(3) ePrivacy (the cookie rule) does not apply. The processing remains personal data processing under the GDPR (the IP is briefly hashed) but the design fits the criteria the CNIL set out in its 2022 guidance for exemption from prior consent (cookieless audience measurement, no cross site tracking, limited purposes, no transfer to third parties for commercial use).
The Spanish AEPD, the German federal and Land DPAs and the Italian Garante have published similar reasoning. As a result, most EU publishers can deploy Ahrefs Analytics on legitimate interest with a documented Legitimate Interest Assessment, and disclose the tool in the privacy notice rather than behind a consent toggle.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Ahrefs Pte. Ltd. is incorporated in Singapore, which does not have an EU adequacy decision. EU customer data is processed on AWS EU regions, but operational access from Singapore (engineering, support) qualifies as an international transfer. The Ahrefs DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum.
A short Transfer Impact Assessment should note the absence of US style mass surveillance laws in Singapore, the limited categories of data processed (no special category data, no identifiers) and the technical measures (hashing, EU storage) that reduce residual risk.
Sign the Ahrefs DPA from your account. Add Ahrefs Analytics to your privacy notice, describing the cookieless design and the transfer to Singapore. Update your Article 30 record. Document a Legitimate Interest Assessment and, if relevant, a Transfer Impact Assessment. The cookie banner is generally not necessary for this tool, but the privacy notice must still inform users.
Websites using Ahrefs Analytics must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is not normally required for Ahrefs Analytics because there are no cookies or local identifiers, no cross site tracking and no profiling. A short legitimate interest balancing test (LIA) is recommended to document the cookieless design and the transfer to Singapore, especially for high traffic publishers and public sector websites.
Sample consent text
We use Ahrefs Analytics (Ahrefs Pte. Ltd., Singapore), a cookieless audience measurement tool that does not set cookies or local identifiers and only sends aggregated, salted data to AWS EU servers. International transfers to Singapore are covered by Standard Contractual Clauses. Details in our privacy policy.
Third-party domains contacted
analytics.ahrefs.comv2.analytics.ahrefs.comstatic.ahrefs.comAhrefs Analytics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
None. Ahrefs Analytics is cookieless by design. The snippet from analytics.ahrefs.com only sends page view events to the Ahrefs backend and does not write any cookie, localStorage, IndexedDB or fingerprint on the visitor's device. Unique visit counting is done server side using a daily rotating salted hash of the IP and user agent.
No, in most EU jurisdictions you do not need prior consent. Art. 5(3) ePrivacy only covers technologies that store information on the visitor's device, which Ahrefs Analytics never does. The cookieless audience measurement exemption confirmed by the CNIL, AEPD and other DPAs applies. You still need to inform users in your privacy notice.
Legitimate interest (Art. 6(1)(f) GDPR) for cookieless aggregated audience measurement. The IP is briefly hashed and never stored in clear text. A short Legitimate Interest Assessment should document the limited purposes and the cookieless design.
Yes. Ahrefs Pte. Ltd. is incorporated in Singapore, which does not have an EU adequacy decision. EU customer data is stored on AWS Frankfurt and Dublin, but support and engineering staff can access it from Singapore. Transfers are covered by the EU Standard Contractual Clauses and the UK IDTA in the Ahrefs DPA.
No, a full DPIA is not normally required because there are no cookies, no cross site tracking, no profiling and no special category data. A short Legitimate Interest Assessment is recommended, plus a Transfer Impact Assessment for the Singapore link.
Sign the Ahrefs DPA, add the snippet to your site, configure the property in your Ahrefs account, list Ahrefs Analytics in your privacy notice and Article 30 record, document the LIA and TIA, and skip the cookie banner. Make sure no other Ahrefs script (Site Audit, Site Explorer crawls) is loaded on visitor pages.
For cookieless EU friendly analytics: Plausible (Estonia), Fathom (Canada with EU servers), Simple Analytics (Netherlands), Pirsch (Germany), Cabin (Ireland), Matomo Cloud EU. Ahrefs Analytics stands out because it is free and integrated with Ahrefs SEO data.
You do not need to list any cookie. In your privacy notice, add a short paragraph naming Ahrefs Pte. Ltd. as the controller of the analytics data, describing the cookieless design, the hashing of IP and user agent, the storage on AWS EU regions and the international transfers to Singapore covered by SCCs.