Prisme

What Prisme is

Prisme is a privacy first web analytics platform from a French team, offered both as a managed service and as open source software. It gives website owners the usual metrics such as visits, page views, referrers and basic device categories, while avoiding the invasive tracking associated with mainstream analytics. The script is very small, around one kilobyte, which keeps pages fast. It is positioned as a respectful alternative to tools that rely on cookies and cross site identifiers.

What data and cookies it collects

Prisme is cookieless and does not set cookies or store persistent identifiers in the browser. Instead of following individuals, it records aggregate events such as a page view together with coarse, non identifying context like the referrer, the page and a broad device or country category. It is designed to avoid collecting data that singles out a specific person, and it does not build cross site profiles. This data minimisation is the core of its privacy first design.

GDPR and ePrivacy implications

Because Prisme does not store or read information on the user device beyond what is strictly necessary, the consent rule in Art. 5(3) of the ePrivacy Directive is generally not triggered. Under the GDPR any data that could still relate to a person is processed on the basis of legitimate interest, supported by strong minimisation and the absence of profiling. Hosting in the European Union means the usual third country transfer concerns do not arise. This combination is what allows many sites to run Prisme without a cookie banner.

Consent requirements

For a standard cookieless deployment, prior consent is generally not required, which is consistent with guidance from European authorities such as the French CNIL on privacy preserving analytics. You should still be transparent in your privacy notice and offer a simple way to object to the processing. If you extend Prisme with custom events that capture identifying details, reassess whether consent becomes necessary. Keep your configuration aligned with the cookieless, aggregate model to stay within the no consent position.

International data transfers

Prisme is made and hosted in the European Union, so in its managed form there is no transfer of personal data to the United States or other third countries. If you self host the open source version, you control the hosting location and can keep everything within the European Economic Area. This avoids the need for Standard Contractual Clauses and transfer impact assessments that burden non European tools. It is a meaningful advantage for organisations focused on data residency.

Practical compliance steps

Add Prisme to your privacy notice as your analytics provider, describing the cookieless, aggregate nature of the measurement and the legitimate interest basis. Document a brief legitimate interest assessment and confirm that no personal identifiers are placed on the device. If you use the managed service, verify the European hosting in your records, and if you self host, keep the deployment within the European Economic Area. Review any custom events you add to ensure they remain privacy preserving.