Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Vercel Analytics is a privacy first, cookieless web analytics product built into the Vercel platform. It measures page views, custom events and Core Web Vitals through a lightweight JavaScript script without setting cookies or storing persistent identifiers on the visitor device. Unique visitors are estimated from a hash that rotates daily, so individuals cannot be tracked across days or across sites. Because no information is stored on or read from the device, a cookie banner is generally not required, although the processing of IP derived data should still rest on a documented legal basis. Data is processed by Vercel Inc. in the United States.
Vercel Analytics is the built in web analytics solution of the Vercel hosting platform. It gives teams traffic, audience and performance insight while taking a deliberately privacy first, cookieless approach, which makes it a popular choice for European websites that want measurement without a heavy consent burden.
Vercel Analytics is offered as Web Analytics for page views and custom events and as Speed Insights for Core Web Vitals. It is enabled per project and loads a small script from the Vercel infrastructure. Unlike traditional analytics, it was designed so that measurement does not depend on cookies or on durable visitor identifiers.
The script records page paths, referrers, device type, browser, operating system and approximate country derived from the IP address, plus any custom events a developer chooses to send. To count unique visitors, Vercel builds a one way hash from request signals including the IP address and a salt that changes every day. The raw IP is not stored and the hash cannot be reversed, so the same person seen on two different days is counted as two visitors.
Vercel Analytics does not set first party or third party cookies and does not write to local storage for tracking purposes. This is the key difference from tools such as Google Analytics. Because nothing is stored on or read from the device, the storage rules of the ePrivacy Directive are generally not triggered, which is why most sites can run it without a cookie wall.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Even without cookies, the brief processing of an IP address to derive the visitor hash can qualify as processing of personal data under the GDPR. A controller therefore still needs a lawful basis, which for privacy friendly measurement is usually legitimate interest. Transparency obligations also apply, so the privacy policy should describe the tool and the absence of cookies.
Vercel Inc. is established in the United States and processes analytics data there. Transfers of any personal data outside the EEA are covered by Standard Contractual Clauses in the Vercel data processing agreement. European controllers should sign that agreement and keep a record of the transfer mechanism in their documentation.
Sign the Vercel data processing agreement, add Vercel as a processor in your record of processing activities, describe the cookieless analytics in your privacy policy, and confirm with your data protection lead that legitimate interest is documented. If you also send custom events, make sure they never contain names, emails or other directly identifying values.
Websites using Vercel Analytics must obtain user consent under GDPR regulations.
DPIA considerations
Vercel Analytics is low risk because it is cookieless and does not build persistent visitor profiles. A short assessment should still document that IP addresses are processed transiently to derive a daily rotating visitor hash, that no raw IP is stored, that no cross site or cross day tracking occurs, and that aggregated metrics cannot reasonably single out an individual. The main residual point to record is the transfer of event data to the United States and the safeguards applied to it.
Sample consent text
This website uses Vercel Analytics to measure aggregated traffic and performance. It does not use cookies and does not store identifiers on your device. Anonymous, aggregated statistics are processed by Vercel Inc. in the United States.
Third-party domains contacted
va.vercel-scripts.comvitals.vercel-insights.comvercel-insights.comThis service may collect user data. Ensure GDPR compliance with FlowConsent.
No. Vercel Analytics is cookieless. It does not set first party or third party cookies and does not use local storage to track visitors. Unique visitor counts come from a hash that is recomputed each day from request signals, not from a stored identifier.
Because no information is stored on or read from the visitor device, the cookie consent rule of the ePrivacy Directive is generally not triggered, so a cookie banner is usually not required. You should still inform users in your privacy policy and rely on a documented legal basis for the IP based processing.
For privacy friendly, aggregated measurement the usual basis under the GDPR is legitimate interest, since the impact on the individual is minimal and no profiles are built. Document a short balancing test and record the basis in your privacy notice.
Yes. Vercel Inc. processes analytics events in the United States. Transfers of any personal data outside the EEA are governed by the Standard Contractual Clauses in the Vercel data processing agreement, which European customers should sign.
A full DPIA is rarely required because the tool is cookieless, does not profile and does not track across sites. A short risk note documenting the transient IP processing, the daily rotating hash and the US transfer is usually sufficient.
Enable it per project, sign the Vercel data processing agreement, add Vercel to your processor records, describe the cookieless analytics in your privacy policy, and make sure any custom events you send contain no directly identifying data.
Yes. Other privacy friendly, cookieless options include Plausible, Fathom, Simple Analytics and Matomo configured without cookies. The right choice depends on whether you need self hosting, EU data residency or deeper analysis features.
Since the tool sets no cookies, you do not add it to the cookie table. Instead, mention in the analytics section of your privacy policy that you use a cookieless measurement tool, that no identifiers are stored, and that aggregated data is processed by Vercel in the United States.