Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
MyStat is a lightweight website analytics and visitor counter service that uses page tags and analytics cookies to measure traffic, unique visitors and returning users.
MyStat is a lightweight website analytics and hit counter service. Site owners add a small page tag to their pages, and MyStat records visits, page views, unique visitors and returning users. It is designed to give a quick overview of traffic without the complexity of a full analytics suite.
Because it relies on a tag loaded in the visitor browser and on cookies to tell visitors apart, MyStat falls squarely within the scope of European cookie and data protection rules.
MyStat typically sets analytics cookies that distinguish first time visitors from returning ones and help estimate unique visits. It also processes technical data such as IP address, browser type, referring page and the pages viewed. Even when no name or email is collected, an IP address combined with a device identifier is considered personal data under the GDPR.
This places MyStat in the category of tracking technologies that require careful handling, clear disclosure and, in most cases, prior consent from the visitor.
Under the ePrivacy Directive, storing or reading information on a visitor device requires consent unless the cookie is strictly necessary. Analytics cookies are not strictly necessary, so they need consent before they are set. The GDPR then governs how the resulting personal data is processed, secured and retained.
Operators must provide transparent information about MyStat in their privacy and cookie notices and must be able to demonstrate a valid legal basis for the processing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent for MyStat must be freely given, specific, informed and unambiguous. The MyStat tag should be blocked until the visitor actively accepts analytics cookies through a consent banner. Pre ticked boxes and implied consent are not valid, and withdrawing consent must be as easy as giving it.
Depending on where the provider hosts its infrastructure, MyStat data may be processed outside the European Economic Area, including in the United States. Such transfers require a valid transfer mechanism, for example Standard Contractual Clauses or reliance on an adequacy decision, together with supplementary measures where needed.
Load MyStat only after consent, list its cookies in your cookie policy with accurate purposes and durations, sign a data processing agreement with the provider, and verify where data is stored. Keep retention to what is necessary and review your configuration regularly to confirm that no analytics cookie is set before the visitor agrees.
Websites using MyStat must obtain user consent under GDPR regulations.
DPIA considerations
Because MyStat sets analytics cookies and can build visitor profiles across sessions, assess the scale of monitoring, the categories of visitors affected and any onward transfer of identifiers. A full DPIA is usually not mandatory for a single low traffic site, but a documented screening assessment is recommended, especially where IP addresses or device identifiers are processed.
Sample consent text
We use MyStat analytics cookies to count visits and understand how our website is used. These cookies are only set if you accept. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
mystat.iocdn.mystat.iostats.mystat.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| is_visitor | Analytics | 5 years | Distinguishes first time visitors from returning ones to estimate unique visits. |
| is_session | Analytics | Session | Tracks a single browsing session to count page views and visit duration. |
| is_unique | Analytics | 1 year | Stores a random visitor identifier used to deduplicate visit counts over time. |
| is_ref | Analytics | 30 days | Records the referring source of a visit for basic traffic source statistics. |
MyStat collects user analytics data — you legally need a consent banner. Try FlowConsent free.
MyStat sets analytics cookies that distinguish first time visitors from returning ones and help estimate unique visits. These cookies usually store a random visitor identifier rather than a name. Because they are not strictly necessary, they require consent before being placed.
Yes. MyStat relies on analytics cookies that are not strictly necessary, so under the ePrivacy Directive prior consent is required before the tag loads. The MyStat script should stay blocked until the visitor accepts analytics cookies.
The appropriate legal basis is the visitor consent under Art. 6(1)(a) GDPR, obtained through a clear cookie banner. Legitimate interest is generally not suitable here because the ePrivacy Directive already requires consent for non essential analytics cookies.
It can. Depending on where the provider hosts its servers, visitor data may be processed outside the European Economic Area, including in the United States. In that case you need a valid transfer mechanism such as Standard Contractual Clauses and any required supplementary measures.
For a single low traffic website a full DPIA is usually not mandatory, but a documented screening assessment is recommended. A DPIA becomes more likely if MyStat is used at large scale or combined with other tracking that enables systematic monitoring.
Block the MyStat tag until consent is given, disclose its cookies in your cookie policy, sign a data processing agreement with the provider and confirm where data is stored. Keep retention short and test that no analytics cookie appears before the visitor accepts.
Privacy friendly, cookieless analytics tools such as Matomo in cookieless mode, Plausible or Fathom can measure traffic with little or no consent burden. They are good options if you want simple statistics while reducing cookie and transfer obligations.
List each MyStat cookie with its name, purpose and duration, state that analytics cookies load only after consent and explain how visitors can withdraw consent. Review the entry whenever the provider changes its cookies or hosting locations.