Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
SuperStats is a hosted web analytics and hit counter service that tracks visitors using a JavaScript tag, server logs and IP based identification, and sets tracking cookies.
SuperStats is a classic hosted web analytics and hit counter service that website owners embed to measure traffic. It works by placing a small JavaScript tag on each page, which reports page views back to the SuperStats servers. The service combines this tag data with server side log analysis and IP address based identification to estimate unique visitors. For European websites it must be treated as a third party analytics tracker rather than a simple counter.
SuperStats collects the visitor IP address, the referring page, the requested page, the user agent string and timestamps. To recognise returning visitors it stores tracking cookies in the browser. Because the IP address is collected and the cookies persist across sessions, the data qualifies as personal data under the GDPR. The combination of cookies and IP based identification means visitors can be singled out across visits.
Storing and reading the SuperStats cookies on a visitor device falls under Art. 5(3) of the ePrivacy Directive, which requires prior informed consent for any storage that is not strictly necessary. Analytics cookies are not considered strictly necessary, so the consent requirement applies. The processing of the IP address and behavioural data then needs a legal basis under Art. 6 of the GDPR. For a non essential analytics tracker that basis is consent under Art. 6(1)(a).
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain freely given, specific, informed and unambiguous consent before the SuperStats tag loads and before any cookie is written. In practice this means the tag should be blocked by your consent management platform until the visitor actively agrees. The consent banner should name SuperStats, explain the analytics purpose, and disclose the transfer to the United States. Visitors must be able to refuse as easily as they accept, and to withdraw consent later.
SuperStats is operated from the United States, so visitor data leaves the European Economic Area and reaches a third country. Such a transfer needs a valid mechanism, either certification under the EU US Data Privacy Framework or Standard Contractual Clauses backed by a transfer impact assessment. You should confirm the current status of the provider and document supplementary measures where the safeguards alone are insufficient. Where no adequate mechanism can be evidenced, the transfer should not take place.
Place SuperStats behind a consent management platform so it only loads after opt in. List the service, its cookies and its retention period in your cookie policy, and name the United States transfer in your privacy notice. Keep records of the legal basis and the transfer mechanism, and review them periodically. If the residual risk stays high, evaluate a cookieless, EU hosted analytics tool as a lower risk replacement.
Websites using SuperStats must obtain user consent under GDPR regulations.
DPIA considerations
Because SuperStats relies on IP based visitor identification and persistent tracking cookies, and because data is transferred to the United States, a data protection impact assessment is recommended. The assessment should document the volume of visitors tracked, the necessity of the processing, the retention period of the statistics, and the transfer impact assessment that supports the international transfer. Consider whether a privacy friendly, EU hosted alternative would reduce the risk before going live.
Sample consent text
We use SuperStats to measure how visitors use our website. With your consent, SuperStats sets cookies and processes your IP address, and this data may be transferred to the United States. You can accept or decline, and you can withdraw your consent at any time.
Third-party domains contacted
superstats.commycomputer.comstats.superstats.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| visitor | third party | 1 year | Persistent visitor identifier used to recognise returning visitors and count unique visitors |
| session | third party | 30 minutes | Session cookie used to group page views into a single visit and to deduplicate hits |
| referrer | third party | session | Stores the original referring source for the current visit so it can be attributed in the statistics |
SuperStats collects user analytics data — you legally need a consent banner. Try FlowConsent free.
SuperStats sets first party style tracking cookies in the visitor browser to recognise returning visitors and to deduplicate sessions. These typically include a visitor identifier cookie and a session cookie. Because they serve analytics rather than a strictly necessary purpose, they are subject to consent.
Yes. The analytics cookies are not strictly necessary, so prior consent is required under Art. 5(3) of the ePrivacy Directive before they are stored. The tag should be blocked until the visitor opts in through your consent banner.
The appropriate legal basis is consent under Art. 6(1)(a) GDPR, because the analytics are not necessary to deliver the website. Legitimate interest is difficult to sustain here given the persistent cookies, the IP based identification and the transfer to the United States.
Yes. SuperStats is operated from the United States, so visitor data including the IP address is transferred to a third country. You need a valid transfer mechanism such as the EU US Data Privacy Framework or Standard Contractual Clauses with a transfer impact assessment.
A data protection impact assessment is recommended because of the combination of IP based identification, persistent cookies and a third country transfer. The assessment should weigh the necessity and proportionality of the analytics and document the safeguards for the United States transfer.
Load the SuperStats tag only after the visitor consents through a consent management platform, and disclose the service in your cookie policy and privacy notice. Record the consent, name the United States transfer, and keep the transfer mechanism evidence on file. Make refusal as easy as acceptance.
Yes. Cookieless, EU hosted analytics tools such as Matomo, Plausible, Pirsch or Stetic can provide traffic insights with lower risk and, when properly configured, sometimes without a consent banner. Migrating reduces the third country transfer exposure that SuperStats creates.
List the SuperStats cookies by name, state their purpose and duration, and identify SuperStats as a United States based processor. Add an entry describing the international transfer and its safeguard, and review the policy whenever the cookies or the provider status change.