---
title: "Web Analytics Compliance Overview for HitKeep | HitKeep"
description: "Review how HitKeep fits GDPR, PECR/ePrivacy, and CCPA work, including cookie-free tracking, data residency, storage, and deployment responsibilities."
canonical: "https://hitkeep.com/compliance/overview/"
---

# Web Analytics Compliance Overview for HitKeep

HitKeep can support a strong privacy and compliance posture. It does **not** make a deployment automatically compliant just because you install it.

The right way to read the compliance docs is:

- **HitKeep can reduce your compliance surface**
- **HitKeep exposes controls that support common obligations**
- **you still need the right lawful basis, notices, contracts, and request-handling workflows**

That matters especially for:

- [GDPR](https://hitkeep.com/compliance/gdpr/)
- [PECR / ePrivacy-style storage rules](https://hitkeep.com/compliance/pecr-eprivacy/)
- [CCPA / CPRA](https://hitkeep.com/compliance/ccpa-cpra/)

Note

This section is product documentation, not legal advice. Privacy compliance depends on your jurisdiction, deployment model, data flows, and business practices. Review your setup with qualified counsel before treating any analytics deployment as compliant.

## Short Answer

| Regime | Does HitKeep help? | Main caveat |
| --- | --- | --- |
| GDPR | Yes, materially | You still need lawful basis, transparency, retention, contracts, and transfer analysis |
| PECR / ePrivacy | Yes, partly | HitKeep is cookie-free by default, but the tracker uses sessionStorage for an opaque session ID and timestamp, so device-storage rules may still apply |
| CCPA / CPRA | Yes, partly | You still need notices, request methods, and opt-out handling where sale/share rules apply |

## What HitKeep Does Today

The current product gives you several controls that matter for privacy programs:

- **Self-hosting or managed cloud:** run HitKeep on your own infrastructure or in [HitKeep Cloud](https://hitkeep.com/pricing/) in the EU or US
- **No analytics cookies by default:** the public tracker does not set browser cookies for analytics
- **Public tracker uses limited `sessionStorage`:** `hk.js` stores a short-lived opaque session ID and timestamp in browser `sessionStorage`
- **No durable browser retry queue:** failed delivery retries stay in JavaScript memory and are capped to a tiny queue
- **Do Not Track respected by default:** browsers sending `DNT: 1` are skipped unless you explicitly override that behavior with `data-collect-dnt="true"`
- **No third-party frontend assets:** dashboard assets and the tracker are served from your own origin
- **No phone-home telemetry:** no external analytics vendor call is required for core product operation
- **Data export and portability:** [site and user takeout](https://hitkeep.com/guides/data/takeout/) in open formats
- **Retention controls:** [per-site retention](https://hitkeep.com/guides/data/retention/) and Parquet archiving
- **Deletion primitives:** admins can delete users and sites; tenant-scoped analytics data is removed with the site lifecycle
- **Security controls:** [HTTP-only auth cookies, TOTP, passkeys, rate limiting, trusted proxies, and same-origin serving](https://hitkeep.com/reference/security/)

## Start With The Right Question

The most important compliance question is not:

> “Is HitKeep compliant?”

It is:

> “How does HitKeep change the technical and contractual risk profile of our analytics deployment?”

For most teams, the practical advantages are:

- smaller analytics surface than ad-tech stacks
- clearer data ownership
- self-hosting when needed
- explicit EU / US cloud region choice
- open-format export and retention controls

The practical caveat is also clear:

- the current public tracker is **cookie-free**, but **not storage-free**
- therefore PECR / ePrivacy analysis still matters

## Pick The Relevant Regime

- [GDPR](https://hitkeep.com/compliance/gdpr/): data minimization, lawful basis, retention, international transfers, and cloud hosting
- [PECR / ePrivacy](https://hitkeep.com/compliance/pecr-eprivacy/): cookies, `sessionStorage`, consent analysis, and dashboard cookies
- [CCPA / CPRA](https://hitkeep.com/compliance/ccpa-cpra/): notice, rights, service-provider positioning, and consumer request handling

## HitKeep Cloud

If you use **HitKeep Cloud**, add these extra checks to your compliance review:

- choose the correct region at signup
- ensure your privacy notice describes the hosted service relationship
- review the [Privacy Policy (Cloud)](https://hitkeep.com/legal/privacy-policy/)
- review the [Terms of Service (Cloud)](https://hitkeep.com/legal/terms-of-service/)
- confirm your own subprocessor, transfer, and retention requirements are satisfied

## Sources

- [EUR-Lex: General Data Protection Regulation (GDPR)](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679)
- [European Commission: Data protection in the EU](https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en)
- [ICO: Cookies and similar technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/)
- [ICO: What are the exceptions?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)
- [CPPA: FAQs](https://cppa.ca.gov/faq)
- [CPPA regulations PDF](https://cppa.ca.gov/regulations/pdf/20230329_final_regs_text.pdf)

[Previous Update opportunity status](https://hitkeep.com/api/operations/apisitesidopportunitiesopportunityid/)[Next GDPR](https://hitkeep.com/compliance/gdpr/)