Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Databuddy is a privacy first, cookieless web analytics platform built for GDPR compliance. It measures visits, page views and conversions using anonymised, aggregated data without setting tracking cookies or building cross site profiles. Hosted in the European Union, Databuddy is designed to run under the ePrivacy security and audience measurement exemptions, offering a consent friendly alternative to traditional analytics for European websites.
Databuddy is a privacy first web analytics platform positioned as a lightweight, cookieless alternative to Google Analytics. It reports the metrics most teams need, visits, page views, referrers, devices, countries and conversion events, without identifying individual visitors. The script is small, loads quickly and is designed so that European publishers can measure their audience while minimising the personal data they process. Databuddy markets itself as compliant by design, with data hosted in the European Union.
Databuddy is built around data minimisation. It does not set persistent tracking cookies and does not store a stable visitor identifier on the device. Instead it derives a short lived, rotating signature from non persistent signals to count unique visits within a day, then discards it. IP addresses are used transiently to derive country and are not stored in raw form. The platform collects page URLs, referrers, browser and device type, screen size and custom events defined by the publisher. No advertising identifiers are created and no data is sold.
Article 5(3) of the ePrivacy Directive only requires consent when a service stores information on, or reads information from, the user terminal. Because Databuddy does not write cookies or read device storage for tracking, it can fall outside the consent trigger of article 5(3). The processing of the resulting analytics data still falls under the GDPR, where the publisher relies on legitimate interest. The CNIL and other European authorities accept that strictly anonymised or carefully scoped audience measurement can be exempt from consent when it serves only the publisher and is not shared.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
When Databuddy is configured in its default cookieless, single site mode, many European regulators accept that no consent banner is required for the analytics itself, in line with the CNIL exemption for audience measurement. Publishers should still inform users in the privacy policy. If the publisher enables any feature that stores an identifier on the device or links data across sites, the exemption no longer applies and prior consent becomes necessary.
Databuddy hosts and processes analytics data within the European Union, which removes the international transfer problem that affects United States based analytics tools. There is no reliance on the EU US Data Privacy Framework for the core service when the EU region is used. Publishers should confirm the configured data region in their account and document Databuddy as a processor with a data processing agreement.
Sign a data processing agreement with Databuddy and record it as a processor in your article 30 register. Keep the deployment in cookieless mode and avoid enabling cross site identifiers if you want to rely on the consent exemption. Describe the audience measurement in your privacy policy, including the categories of data and the retention period. Even though no consent banner is strictly required, give users a clear way to object, and review the configuration whenever Databuddy adds new features.
Websites using Databuddy must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is generally not required for Databuddy in its cookieless, anonymised configuration because it processes minimal data and creates no persistent identifier. Reassess if you enable identifiers, combine analytics with other data sets or track sensitive content.
Sample consent text
We use Databuddy, a privacy first and cookieless analytics tool hosted in the European Union, to understand how our site is used. Databuddy does not set tracking cookies, does not store a persistent identifier on your device and does not build a cross site profile. The aggregated data stays in the European Union. Because it is strictly scoped audience measurement, it runs under the ePrivacy exemption; you can still object at any time.
Third-party domains contacted
databuddy.ccbasket.databuddy.ccapp.databuddy.cccdn.databuddy.ccDatabuddy collects user analytics data — you legally need a consent banner. Try FlowConsent free.
No. Databuddy is cookieless by design. It does not write tracking cookies and does not store a persistent identifier on your device. To count unique visits it derives a short lived, rotating signature from non persistent signals and discards it, which is why it can avoid the consent trigger that applies to cookie based analytics.
In its default cookieless, single site configuration, Databuddy can rely on the ePrivacy audience measurement exemption recognised by the CNIL and similar authorities, so a consent banner is usually not required for the analytics itself. You must still inform visitors in your privacy policy, and consent becomes necessary if you enable any identifier or cross site feature.
The publisher relies on legitimate interest under GDPR article 6(1)(f) for measuring its audience. Because Databuddy does not access device storage for tracking, the article 5(3) ePrivacy consent requirement is generally not triggered when the tool is used in its anonymised, single site mode.
No, when the European Union region is used. Databuddy hosts and processes analytics data within the EU, so there is no reliance on the EU US Data Privacy Framework for the core service. Confirm your configured data region and document it in your records.
A DPIA is generally not required for the cookieless, anonymised configuration because the data is minimal and no persistent identifier is created. Reassess if you enable identifiers, combine Databuddy data with other sources or measure sensitive content.
Sign a data processing agreement, record Databuddy as a processor, and keep the deployment in cookieless mode without cross site identifiers. Describe the audience measurement and retention in your privacy policy and offer a clear way to object, even though no consent banner is strictly required.
Other privacy friendly, often cookieless analytics include Plausible, Matomo configured without cookies, Fathom, Simple Analytics and Umami. Google Analytics is the main alternative but it relies on cookies and United States transfers, so it requires consent and a stronger transfer analysis.
Because Databuddy sets no cookies, your cookie policy can state that the analytics is cookieless and stores no identifier on the device. Mention Databuddy in the analytics section of your privacy policy, describe the data collected and the EU hosting, and note that it operates under the ePrivacy audience measurement exemption.