CNIL self-assessment of Statsdot
Updated November 3, 2026
Based on our self-assessment, Statsdot meets the criteria set by the CNIL (Cookies : solutions pour les outils de mesure d'audience) and can be used without asking visitors for consent if it is configured as described on this page. This is our own assessment, made with the self-assessment tool the CNIL published in July 2025, and it does not bind the CNIL. The CNIL does not certify or approve tools. The French version is the reference.
With the CNIL exemption mode on, Statsdot is limited to:
- measuring performance;
- detecting navigation problems;
- optimising technical performance or usability;
- estimating the server capacity needed;
- analysing the content viewed.
It explicitly excludes any marketing measurement, including but not limited to the performance of conversion channels or advertising campaigns, the measurement of acquisition channels and ad fraud detection, and any creation of user cohorts to show them different content.
Every criterion below is met when the configuration is applied. Where the site owner has to act, it is in the last column. If the site owner does not do it, the site may no longer benefit from the exemption.
This assessment only covers whether Statsdot can be used without prior consent. It does not assess the compliance of the whole service with the applicable law.
The criteria
The only purpose is audience measurement
| Criterion | Met | How | What the site owner does |
|---|---|---|---|
| Instructions to turn off any feature outside this purpose | Yes | One switch per site, the CNIL exemption mode, turns off every such feature: campaign tags, channels, revenue, conversion ids, custom properties, imports and Search Console. | Turn on the mode in the site settings, section General. |
| Data from HTTP headers is minimised (for example, the major version of the system or browser) | Yes | Statsdot keeps the browser name and the system name without version, and a device type (mobile, tablet, desktop) from the screen width. Never the full user agent. | Nothing. |
| At most three types of event: presence on a page; use of a feature (button or link click) with its details; load time, scroll or time on page | Yes | Pageviews with the page path; events from clicks on buttons, links and forms with their label, outbound links and downloads with their address; scroll depth per page and visit duration. In the mode, purchases are recorded as events without an amount. | Do not put personal data (names, emails, order numbers) in event labels or page addresses. |
The provider works as a processor
| Criterion | Met | How | What the site owner does |
|---|---|---|---|
| A standard data processing agreement with the content of article 28 of the GDPR, naming the provider as processor | Yes | The data processing agreement is an annex to the terms of service and applies without a separate signature. | Nothing. |
| No pooling of raw measurement data from several customers | Yes | Each site's data is stored and shown separately, only to the account of that site. The visitor code includes the site, so the same person gets different codes on different sites. | Nothing. |
| No reuse of the data for the provider's own purposes (improving its service, fraud detection, etc.) | Yes | Statsdot does not use customer statistics for itself: no benchmarks, no product analysis, no sale. | Nothing. |
| A contact point for questions and complaints about compliance | Yes | [email protected] | Nothing. |
No tracking of the person outside the site
| Criterion | Met | How | What the site owner does |
|---|---|---|---|
| No import of external data: no customer (CRM) identifier, UTM tag or campaign id from URLs; the referrer, if collected, is limited to the host; no integration with third-party tools | Yes | In the mode the server drops UTM tags and conversion ids. Query strings are never stored, and the referrer is stored as a host only. Imports from other tools and Search Console are off. Daily totals imported before the mode was turned on stay visible; they carry no identifier. | Turn on the mode. To keep no earlier import, delete it in the settings, section Import. |
| If the identifier is a cookie, it is first-party | Yes | Statsdot sets no cookie and stores nothing on the device for measurement. | Nothing. |
| The IP address, if used, gives the location at city level and is then pseudonymised by removing at least the last octet | Yes, alternative measure | Statsdot does not use the IP address for location: country, region and city come from headers that Cloudflare, our network provider, adds to the request. The IP address is never stored. It is used only in memory to compute the daily visitor code (next row), then discarded. | Nothing. |
| A fingerprint, if computed, includes a site component and a time component, so it cannot follow a person across sites and has a limited lifetime | Yes | The visitor code is a truncated SHA-256 of a random key, the site, the IP address and the user agent. The key changes every UTC day and is deleted, so the same person gets a different code on each site and each day. | Nothing. |
| No tag that collects personal information, for example from forms | Yes | The script never reads form fields. A form event records only the event name and label chosen by the site owner. Query strings are removed from page paths, and order numbers in common shop addresses are collapsed. | Do not send personal data as labels. |
| No feature that matches, deduplicates or measures a unified reach | Yes | No such feature. | Nothing. |
The data only produces anonymous statistics
| Criterion | Met | How | What the site owner does |
|---|---|---|---|
| Every report, on screen and in exports, holds anonymous statistics only (CNIL measure: aggregation and presentation to the nearest ten) | Yes | In the mode every count is rounded to the nearest ten: dashboard, shared links, email reports, CSV export, API, MCP server, Looker Studio connector and live widget. Rows that round to zero are not shown. Rates and averages are only shown for at least 5 visitors. | Turn on the mode. |
| Anonymisation holds whatever selection criteria the customer chooses (no combination of criteria isolates a user) | Yes | A filter or combination of filters whose visitors round to zero shows nothing, and every row shown needs at least 5 visitors. | Nothing. |
| No tracking of a single user's navigation (no session replay) | Yes | No session replay, no visit log, no per-visitor rows in any report or in the API. Journeys show previous and next pages aggregated over at least 5 visitors. | Nothing. |
Visitors can object
| Criterion | Met | How | What the site owner does |
|---|---|---|---|
| An opt-out, as a button or link in the privacy policy of the site | Yes | The opt-out script shows a sentence and a button. | Add the opt-out snippet to the privacy policy page. |
| The refusal is kept over time (opt-out cookie, or the fingerprint added to an exclusion list) | Yes, alternative measure | The choice is saved in the browser's local storage for the site instead of a cookie. The Statsdot script reads it before sending anything, so nothing is sent while it is set. It lasts until the visitor clears the site's data. | Nothing. |
Also recommended by the CNIL
- Information: the privacy policy describes the measurement. A text to adapt is in the CNIL mode guide.
- Retention: visits are deleted after the retention of the plan, at most 24 months. The CNIL recommends at most 25.
- Trackers: Statsdot sets none, so their lifetime (13 months recommended) does not apply.