> How OneStat web analytics handles cookies and data, and what GDPR and ePrivacy require. A practical consent and compliance guide for European website operators. > > Canonical: https://www.flowconsent.com/en/services/analytics/onestat Analytics # OneStat Analytics · [Official website](https://www.onestat.com) OneStat is a hosted web analytics service that uses a JavaScript page tag and cookies to track visitors, recording a unique visitor identifier, IP address and navigation behaviour. [Block OneStat until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers OneStat.com servers (provider operated). Hosting is not transparently disclosed, so a transfer assessment of the provider infrastructure is advisable Overview ## What does OneStat do? ## What OneStat is OneStat is a hosted web analytics service offered at onestat.com. The operator inserts a small JavaScript page tag into the website, and OneStat then records statistics about visits, such as pages viewed, time on page, referral source and navigation paths. It is a software as a service product, so the data is processed on OneStat own systems rather than on the operator server. For a European audience OneStat is a classic third party analytics tool: useful for understanding traffic, but reliant on cookies and the processing of visitor data that fall squarely within GDPR and ePrivacy rules. ## What data and cookies it collects OneStat sets a unique visitor cookie that identifies each browser by a random number, allowing it to distinguish new and returning visitors. Alongside the cookie it records the IP address, the browser string, the pages visited, the duration of each view and the previous page, building a profile of navigation behaviour. Although the visitor is identified only by a random number rather than a name, the combination of a persistent identifier with the IP address and behaviour constitutes personal data under the GDPR. ## GDPR and ePrivacy implications The OneStat analytics cookie is not strictly necessary for the website to function, so it falls under Article 5(3) of the ePrivacy Directive and requires prior consent. The associated processing of the IP address and behaviour needs a legal basis under Article 6 of the GDPR, and the operator must inform visitors clearly and honour their rights. OneStat acts as a processor on behalf of the website operator, so a data processing agreement is required, and the operator remains the controller responsible for lawfulness and transparency. ## Consent requirements Because the analytics cookie is non essential, valid prior consent must be collected before the OneStat tag loads and before the cookie is set. The consent must be freely given, specific, informed and unambiguous, and the consent banner must let visitors refuse as easily as they accept, with no tracking taking place until acceptance. ## International data transfers As a hosted service, OneStat receives the analytics data on its own servers. The operator should confirm where OneStat stores and processes the data, and if any of that processing takes place outside the European Economic Area, put in place a valid transfer mechanism such as standard contractual clauses together with a transfer impact assessment. ## Practical compliance steps Load the OneStat tag only after consent, sign a data processing agreement, and confirm the hosting location and transfer safeguards. Describe the analytics cookie and the data collected in your cookie policy and privacy notice, set a proportionate retention period, and consider IP truncation or an EU hosted analytics alternative if you want to minimise risk. Compliance ## OneStat and the GDPR OneStat is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for the analytics cookies and tracking, in line with Art. 5(3) of the ePrivacy Directive - Risk level medium - Applicable regulations GDPR, ePrivacy Directive ### Impact assessment (DPIA) OneStat assigns a unique visitor cookie and records IP addresses and navigation behaviour, which is a regular monitoring of visitors but on a smaller and less intrusive scale than identification or enrichment tools. A full DPIA may not always be mandatory, yet a documented risk assessment is advisable, especially regarding where the provider stores and processes the data. ### Sample text for your banner > With your consent we use OneStat to measure how our website is used. This sets analytics cookies and records information such as your IP address, the pages you view and your browser. You can refuse or withdraw your consent at any time in the cookie settings. Cookies and trackers ## What OneStat sets and contacts - Tracking method Hosted web analytics using a JavaScript page tag and cookies; assigns a unique visitor cookie and records IP address, browser string and navigation data - Server location OneStat.com servers (provider operated). Hosting is not transparently disclosed, so a transfer assessment of the provider infrastructure is advisable - Data transferred outside the EU OneStat is a hosted service and collected analytics data, including the visitor IP address and a unique visitor identifier, is sent to and stored on OneStat operated servers. Where any processing occurs outside the EEA, the operator must rely on a valid transfer mechanism such as standard contractual clauses. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------------- | --------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OneStatUniqueVisitor | Analytics | 2 years | Unique visitor cookie that identifies the browser by a random number so OneStat can distinguish new and returning visitors. Not strictly necessary, so it requires prior consent. | | OneStatSession | Analytics | 30 minutes | Session cookie used by OneStat to group page views into a single visit and measure session duration. Requires prior consent. | | OneStatReferrer | Analytics | Session | Stores the referral source for the current visit so OneStat can attribute traffic and campaigns. Requires prior consent. | | OneStatFirstVisit | Analytics | 2 years | Records the timestamp of the first visit to help OneStat distinguish first time from repeat visitors over time. Requires prior consent. | ### Third-party domains contacted (3) - `onestat.com` - `stat.onestat.com` - `onestatfree.com` Questions ## Frequently asked questions about OneStat Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does OneStat set? OneStat sets analytics cookies, most notably a unique visitor cookie that identifies the browser by a random number, along with session and referral cookies. These cookies are not strictly necessary, so they require prior consent before they are placed. ### Is consent required for OneStat? Yes. The OneStat analytics cookie is non essential, so under Article 5(3) of the ePrivacy Directive prior consent is required before it is set. The tag should not load and no cookie should be placed until the visitor has actively accepted. ### What is the legal basis for processing with OneStat? Consent under Article 6(1)(a) of the GDPR is the appropriate basis, because the service relies on non essential analytics cookies and processes the IP address and behaviour. This aligns with the consent requirement of Article 5(3) of the ePrivacy Directive. ### Does OneStat transfer data outside the EU, to the US in particular? OneStat is a hosted service, so the analytics data is sent to its own servers. The operator should confirm the hosting location and, if any processing occurs outside the EEA, put a valid transfer mechanism such as standard contractual clauses in place. ### Is a DPIA needed for OneStat? A full DPIA is not always mandatory for standard OneStat analytics, since it is less intrusive than identification tools. A documented risk assessment is nonetheless advisable, particularly to confirm where the provider stores and processes the data. ### How do I implement OneStat compliantly? Load the OneStat tag only after consent, sign a data processing agreement, and verify the hosting and transfer safeguards. Describe the analytics cookies in your cookie policy, set a proportionate retention period, and consider IP truncation to reduce the data footprint. ### What are the alternatives to OneStat? Privacy friendly alternatives include EU hosted analytics such as Matomo and Plausible, which can be configured to avoid third country transfers and, in some cases, to run without cookies. These options often reduce the consent and transfer burden compared with a hosted tool. ### How do I update the cookie policy for OneStat? List the OneStat unique visitor cookie and any session or referral cookies with their purpose and duration, and state that analytics data is sent to OneStat servers. Review and update the policy whenever the OneStat configuration or the set of cookies changes. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [UXsniff](https://www.flowconsent.com/en/services/analytics/uxsniff) [UXSniff is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. UXSniff offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, UXSniff empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/uxsniff) [Analytics](https://www.flowconsent.com/en/services/analytics/uxsniff) · ### [Analysys Ark](https://www.flowconsent.com/en/services/analytics/analysys-ark) [Analysys Ark is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Analysys Ark supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Analysys Ark enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/analysys-ark) [Analytics](https://www.flowconsent.com/en/services/analytics/analysys-ark) · ### [Webolytics](https://www.flowconsent.com/en/services/analytics/webolytics) [Webolytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Webolytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Webolytics enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/webolytics) [Analytics](https://www.flowconsent.com/en/services/analytics/webolytics) · ### [Segmanta](https://www.flowconsent.com/en/services/analytics/segmanta) [Segmanta is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Segmanta supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Segmanta enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/segmanta) [Analytics](https://www.flowconsent.com/en/services/analytics/segmanta) · ### [SimpleSat](https://www.flowconsent.com/en/services/analytics/simplesat) [SimpleSat is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SimpleSat offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SimpleSat empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/simplesat) [Analytics](https://www.flowconsent.com/en/services/analytics/simplesat) · ### [Nepcha Analytics](https://www.flowconsent.com/en/services/analytics/nepcha-analytics) [Nepcha Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Nepcha Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Nepcha Analytics enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/nepcha-analytics) [Analytics](https://www.flowconsent.com/en/services/analytics/nepcha-analytics) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)