Agencies: who is responsible for the analytics of client sites?

An agency that installs analytics on its clients' sites sits in the middle of a chain of responsibilities. The GDPR has precise words for it, and a wrong role shows on the day a visitor makes a request, an authority inspects, or the contract ends. It is general information, not legal advice.

Who does what

Party	Usual role	Why
The client, owner of the site	Controller	Decides to measure its site and for what purpose
The agency	Processor	Installs and runs the tool for the client, on its instructions
The analytics tool	Processor, or sub-processor	Processes the data for whoever opens the account

The agency changes role if it uses the data for itself, for example to compare all its clients' sites. It then becomes a controller for that use, and in France the measurement leaves the CNIL exemption, which forbids pooling raw data from several site owners.

Two ways to set up the accounts

The client opens the account. The client signs up with the provider, accepts its data processing agreement and invites the agency as a team member. The chain is short: client and provider have a direct contract, and the agency's access falls under its own contract with the client. When the work ends, the client removes the agency from the team and keeps its history.

The agency opens the account. The agency groups all its clients in one account, which makes billing simpler. The provider is then a sub-processor. The agency needs its client's authorisation to use it (article 28(2) GDPR), has to pass on the same obligations (article 28(4)) and should name it in the data processing agreement it signs with the client. When the work ends, plan the export or deletion of the site's data.

The agency's checklist

1. A data processing agreement with each client that names the analytics tool and its sub-processors.
2. For sites in France that go without consent, the tool set up for the CNIL criteria, site by site. In Statsdot that is the CNIL exemption mode.
3. The audience measurement text and the opt-out button in each site's privacy policy (template in Privacy policy: what to write about audience measurement).
4. Access at the right level: the client as a viewer, a shared link only if the numbers may be public, email reports to the right addresses.
5. A retention period chosen and written down, 25 months at most.
6. No comparison between clients from raw data.
7. What happens when the contract ends: export of the history, handover or deletion.

In Statsdot

The owner of an account invites members as viewers or managers; a manager can change site settings and add sites to the account, never billing or deleting. The Growth plan covers up to 30 sites, and each client can get its report by email or a read-only link. How it works is in Analytics for agencies and in the team guide.