> Histats cookies, hit counter widget, third party identifiers, ePrivacy obligations and how to deploy Histats on European websites under the GDPR. > > Canonical: https://www.flowconsent.com/en/services/analytics/histats Analytics # Histats Analytics Histats is a free hit counter and visitor analytics service launched in the early 2000s and operated from Romania. The product is widely used by personal websites, blogs and small forums for the live counter widget and a basic dashboard with country statistics, referrers and search keywords. The script sets third party cookies, exchanges identifiers with the Histats ad network when monetisation is enabled, and offers limited transparency on sub processors, which makes Histats a high risk tracker under the GDPR and the ePrivacy Directive. [Block Histats until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Histats is operated from Romania, an EU member state. Production servers are reported to be located in the EU, but the operator does not publish a detailed sub processor map and the historical service has had limited transparency about hosting partners. Overview ## What does Histats do? ## **What Histats is** Histats is a long running free hit counter and visitor analytics service operated from Romania. It is widely embedded on personal sites, blogs, forums and legacy CMS templates that rely on a public counter and a simple dashboard with country, referrer and keyword breakdowns. Many sites continue to load Histats long after the publisher has stopped using its admin console. ## **What data Histats collects** The Histats script captures page views, IP based geolocation, referrer, user agent, screen resolution, time of day and an internal visitor identifier stored in third party cookies (HSCK, HSALT). When the publisher activates monetisation, additional advertising signals are exchanged with partner networks. The public counter widget itself reveals aggregate traffic numbers to anyone who can see the site. ## **GDPR and ePrivacy implications** The Histats cookies fall under Article 5(3) ePrivacy. The persistent visitor identifier and the integration with advertising partners constitute personal data processing under Article 4(1) GDPR. Without a comprehensive sub processor list and a clear DPA, the standard fallback is consent under Article 6(1)(a) GDPR and tag blocking until consent is granted. ## **Consent requirements** The Histats script must be tag blocked until explicit, granular opt in consent is given. The consent message should mention Histats, the basic analytics purpose and, when relevant, the Histats ad network. A clear refuse option must be available, and the choice must be revocable at any time. Older Histats integrations that load the script unconditionally are not compatible with the GDPR. ## **International data transfers** Histats is operated from Romania (EU). Production servers are reported to be in the EU, but the absence of a public sub processor list and the legacy operational practice of free counter services means a transfer impact assessment is required. Customers should request a written commitment that no personal data is transferred to non EEA partners and apply Standard Contractual Clauses if any partner outside the EEA is involved. ## **Practical compliance steps** In most cases, the cleanest path is to remove Histats and replace it with a privacy first analytics tool (Plausible, Matomo, Fathom, Umami, Rybbit). If you keep Histats, request a DPA, document a transfer impact assessment, tag block the script until consent, list Histats in the privacy and cookie policies and disable the monetisation hooks unless they have a clear legal basis. Compliance ## Histats and the GDPR Histats is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy Directive) for the Histats cookies and the visitor profiling. Legitimate interest is not admissible because Histats also offers monetisation features that share data with advertising partners, and the operator does not provide enough transparency to support a Legitimate Interest Assessment. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, Romanian ANSPDCP guidelines, French CNIL guidelines, German TTDSG, Spanish LSSI, Italian Garante guidelines ### Impact assessment (DPIA) A DPIA is recommended for Histats given the persistent third party identifiers, the lack of transparent sub processor information, the integration with the Histats ad network and the historical positioning as a free service funded by advertising signals. ### Sample text for your banner > We use Histats to count visitors and to display a public hit counter. Histats sets cookies and may share data with the Histats ad network. We only load Histats after you click Accept. You can withdraw your consent at any time from the cookie settings. Cookies and trackers ## What Histats sets and contacts - Tracking method JavaScript counter and tracking script (s4.histats.com/js15\_as.js, hits.histats.com/hits-w\.html), third party cookies, embedded counter image, IP based geolocation, optional referrer and exit link tracking, monetisation hooks for the Histats ad network. - Server location Histats is operated from Romania, an EU member state. Production servers are reported to be located in the EU, but the operator does not publish a detailed sub processor map and the historical service has had limited transparency about hosting partners. - Data transferred outside the EU Histats does not publish a comprehensive list of sub processors. Some advertising integrations route data through partners outside the EEA. Customers should treat the deployment as a likely third country transfer in the absence of explicit documentation, run a transfer impact assessment and apply Standard Contractual Clauses with supplementary measures. ### Cookies set (3) | Name | Type | Duration | Purpose | | ----- | ---------- | --------- | ------------------------------------------------------------------------------------------------------------------------------- | | HSCK | persistent | 6 months | Histats third party cookie that identifies a unique browser across pages and sites that include the Histats counter or tracker. | | HSALT | persistent | 13 months | Stores a salted alternative identifier used by Histats to deduplicate visits and to feed audience reports. | | HSSRC | persistent | 6 months | Records the original referrer source so Histats can attribute the visit in dashboards. | ### Third-party domains contacted (4) - `histats.com` - `s4.histats.com` - `hits.histats.com` - `sstatic1.histats.com` Questions ## Frequently asked questions about Histats Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Histats set? Histats sets the third party cookies HSCK, HSALT and a session level cookie on histats.com. They persist for several months and identify a unique browser across pages that include the Histats counter or tracking script. ### Do I need consent to use Histats? Yes. The cookies fall under Article 5(3) ePrivacy and the visitor profiling under Article 6(1)(a) GDPR. The Histats script must be tag blocked until explicit, granular opt in consent is collected. ### What is the legal basis for Histats? Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy). Legitimate interest is not admissible because the persistent identifier and the optional advertising integration build cross site profiles, even when the publisher only intends to use the basic counter. ### Does Histats transfer data to the US? Histats is operated from Romania, an EU member state. Production servers are reported to be in the EU, but the lack of a public sub processor list means a transfer impact assessment is recommended and SCC may be required if any partner outside the EEA is involved. ### Do I need a DPIA for Histats? A DPIA is recommended for any meaningful European deployment, given the persistent third party identifiers, the optional ad network integration and the limited transparency on sub processors. ### How do I implement Histats compliantly? Tag block the Histats script until consent, request a DPA from the operator, document a transfer impact assessment, list Histats in the privacy and cookie policies, and disable any monetisation hooks unless you have a clear legal basis. In most cases the cleanest path is to migrate to a privacy first analytics tool. ### What are the alternatives to Histats? Privacy first analytics tools that replace Histats neatly include Plausible (EU hosted, cookieless), Fathom (EU hosted), Umami (self hosted), Matomo (self hosted in cookieless mode), GoatCounter (open source), Rybbit and Pirsch (Germany). All can run without consent banners under the CNIL exemption when properly configured. ### How do I update the cookie policy for Histats? List Histats with the operator (Histats S.R.L., Romania), the purpose (visitor counter and audience analytics), the cookies (HSCK, HSALT) with retention, the legal basis (consent), the storage location (EU) and a note on the limited transparency about sub processors and any monetisation features you have enabled. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Peripl](https://www.flowconsent.com/en/services/analytics/peripl) [Peripl is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Peripl supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Peripl enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/peripl) [Analytics](https://www.flowconsent.com/en/services/analytics/peripl) · ### [API Spreadsheets](https://www.flowconsent.com/en/services/analytics/api-spreadsheets) [API Spreadsheets is an integration and connectivity platform that enables businesses to connect web applications, APIs, and services seamlessly. It provides pre-built connectors, webhook management, and data synchronization. API Spreadsheets supports real-time data flow between marketing, sales, and operational tools, eliminating data silos and manual processes. With visual workflow builders and robust API management, API Spreadsheets helps create unified digital ecosystems that drive efficiency.](https://www.flowconsent.com/en/services/analytics/api-spreadsheets) [Analytics](https://www.flowconsent.com/en/services/analytics/api-spreadsheets) · ### [comScore](https://www.flowconsent.com/en/services/analytics/comscore) [comScore is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. comScore supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, comScore enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/comscore) [Analytics](https://www.flowconsent.com/en/services/analytics/comscore) · ### [Zeotap](https://www.flowconsent.com/en/services/analytics/zeotap) [Zeotap is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Zeotap offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Zeotap empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/zeotap) [Analytics](https://www.flowconsent.com/en/services/analytics/zeotap) · ### [Pinpoll](https://www.flowconsent.com/en/services/analytics/pinpoll) [Pinpoll is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Pinpoll supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Pinpoll enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/pinpoll) [Analytics](https://www.flowconsent.com/en/services/analytics/pinpoll) · ### [Biano](https://www.flowconsent.com/en/services/analytics/biano) [Biano is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Biano supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Biano enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/biano) [Analytics](https://www.flowconsent.com/en/services/analytics/biano) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)