Compliance

Exactly what is collected

Nothing is written to the visitor’s device: no cookies, localStorage, sessionStorage or IndexedDB. Each stored pageview holds the time, day, daily visitor ID, path, referrer host, country and region, device, browser and OS family, screen size and any UTM tags. Custom events (optional) are stored separately. If you switch on click tracking (data-clicks), avoid it on pages where buttons or links show personal details, because the visible text becomes the label. The full method is on the methodology page.

PECR and the statistical-purposes exception

Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) covers storing information on, or accessing information from, a user’s device. It is wider than cookies. quietstats stores nothing on the device. It does read the screen size, which could be treated as access.

The Data (Use and Access) Act 2025 added an exception: you do not need consent when the sole purpose is collecting information for statistics about how your website is used, so you can improve it. In return you must:

• give clear and comprehensive information about the analytics, usually in your privacy notice (see the wording below);
• give visitors a simple, free way to object. quietstats honours Do Not Track and Global Privacy Control, and you can link to how to switch them on;
• use the data for aggregate statistics only, never for advertising, profiling or decisions about individuals.

ICO guidance: What are the exceptions? · Storage and access technologies · The Data (Use and Access) Act 2025 · PECR regulation 6

UK GDPR: who does what

The IP address and user agent are personal data, and quietstats processes them for a moment to make the daily visitor ID. So we say “no personal data is stored”, not “no personal data is processed”.

• You (the website owner) are the controller for your visitors’ data. Legitimate interests is the usual lawful basis for privacy-friendly analytics; a short legitimate interests assessment is good practice.
• quietstats acts as your processor, and only processes visitor data to give you your statistics.
• For our own customers’ account data (email address, password hash, plan, billing IDs), quietstats is the controller.

Data processing agreement (DPA): a customer DPA is being prepared and will be reviewed by a solicitor before it is published. It is not available yet.

Sub-processors

Cloudflare’s customer DPA: cloudflare.com/cloudflare-customer-dpa. We will list any new sub-processor here before we start using it.

Data location

The database is a Cloudflare D1 database created with a Western Europe location hint (Cloudflare’s weur region). Requests are first handled at the Cloudflare data centre nearest the visitor, which can be anywhere in Cloudflare’s global network. quietstats is built in the UK, but it does not claim to be UK-hosted.

Cloudflare docs: D1 data location.

Retention

Wording for your privacy notice

Copy this into your privacy or cookie notice and adjust it to fit. It covers the “clear and comprehensive information” and the objection route.

We use quietstats, a cookie-free analytics service, to count visits to this website in aggregate. It sets no cookies, stores nothing on your device and does not store your IP address or any identifier. Each day a temporary random value is mixed with your connection details to count unique visits, and it is then destroyed. We only see aggregate statistics (such as page views, referrers, countries and device types), and we use them only to improve this website. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded.

Consent banners and consent mode

quietstats does not read or set any consent signal: not Google Consent Mode, not the IAB TCF string, and not your banner’s cookie. It behaves the same whatever your banner says. That leaves two ways to run it:

1. Outside the banner (the usual choice for cookie-free analytics). Load the normal snippet on every page and describe it in your privacy notice. It sets no cookies, so it does not belong in your cookie list; describe it as analytics without cookies. This relies on the statistical-purposes exception above, so the conditions there apply.
2. Behind the banner. If your policy is that all analytics waits for consent, put quietstats in your banner’s analytics or statistics category, or load it from the banner’s consent callback with the code below. The script works the same when it is added after the page has loaded. Expect lower numbers: visitors who decline, or never answer, are not counted.

// Optional: load quietstats only after your consent banner says yes.
function loadQuietstats() {
  var s = document.createElement('script');
  s.src = 'https://quietstats.co.uk/js/script.js';
  s.id = 'YOUR_SITE_ID';
  s.setAttribute('data-host', 'https://quietstats.co.uk');
  s.setAttribute('data-dnt', 'true');
  s.async = true;
  document.head.appendChild(s);
}
// Call loadQuietstats() from your banner's "analytics accepted" callback.

• Google Consent Mode only changes how Google’s own tags behave. It has no effect on quietstats, so if you also run Google Analytics with consent mode, expect the two sets of numbers to differ.
• Keep data-dnt="true" in either set-up, so Do Not Track and Global Privacy Control still switch counting off.
• There is no opt-out cookie, because that would mean storing something on the visitor’s device. Global Privacy Control is the opt-out.

Visitors from the EU

EU visitors are covered by the EU ePrivacy rules, which differ from PECR and vary between countries. Many cookie-free analytics tools run without consent in the EU, but that is not guaranteed everywhere. If most of your visitors are in the EU, check the rules in their countries.