Skip to content

Privacy policy: what to write for audience measurement without consent

Updated November 3, 2026

The CNIL exemption removes the banner, not the duty to inform. The GDPR (article 13) asks you to inform visitors of any processing of personal data, the CNIL recommends doing it in the privacy policy, and its July 2025 grid puts the opt-out button there. This is what to write, with a template to adapt. It is general information, not legal advice.

What to include

  • The controller. You, the site owner, with your contact details.
  • The purpose. Anonymous traffic statistics for your own use. No advertising, no profiles.
  • The data used. Pages viewed, referring site (the host only), country, device type, browser and system. Also say that the IP address passes through the measurement server, even if it is not kept.
  • The legal basis. Usually legitimate interest (article 6(1)(f) GDPR): knowing your site's audience. The article 82 exemption is about trackers; the processing of the data still needs a legal basis.
  • Retention. The period you chose, 25 months at most as the CNIL recommends.
  • Recipients. You, and the tool's provider as processor, with its own sub-processors if they see the data (hosting, network).
  • Transfers outside the EU. If there are any, and on what basis. A US content delivery network sees the requests pass, even when the statistics are stored in Europe.
  • Rights. Access, objection, complaint to the CNIL. For anonymous statistics access is often impossible in practice; objection has to work.
  • The opt-out button. A button or link that stops the measurement for that browser.

A template for Statsdot

Replace the parts in brackets:

Audience measurement. We measure visits to [site name] with Statsdot to produce anonymous statistics on how it is used: pages viewed, referring sites, country, device type and browser. This processing is based on our legitimate interest in knowing our site's audience.

Statsdot sets no cookies and does not store your IP address. It is used only during the request to compute a code that changes every day; that code cannot recognise you on another day or on another site. The statistics are kept for [24] months.

Statsdot is our processor and does not reuse this data. It is stored on servers in Germany; requests pass through Cloudflare, Inc. (United States), under the EU-US Data Privacy Framework.

You can object to this measurement with the button below, and send any complaint to the CNIL (cnil.fr).

Then add the opt-out button; the snippet is in the CNIL mode guide.

Common mistakes

  • Copying a Google Analytics paragraph. A text about _ga cookies and consent, for a tool that sets none, misleads the visitor.
  • Writing "no personal data". The IP address passes through the server, even briefly. Describe what is kept and what is not.
  • Promising everything stays in Europe. If a US network is on the way, say so.
  • Forgetting the rest of the site. Embedded videos, advertising pixels or chat have their own notices, and often need consent.
  • An opt-out button nobody can find. It belongs in the privacy policy, visible, and it must work without an account.

The full list of CNIL criteria is in The CNIL consent exemption: the July 2025 criteria explained, and what Statsdot does for each one in our self-assessment.