Installing Analytics Without Breaking Privacy Rules

What analytics actually collects

Worth knowing before deciding what to disclose, because most business owners have never looked.

Pages visited and the order. Time on each. Where the visitor came from. Approximate location, derived from the network address. Device, browser and screen size.

Also an identifier stored on the visitor's device so that returning visits can be recognised as the same person.

That identifier is the part that makes this a privacy question rather than a simple counting exercise, and it is the reason disclosure is expected at all.

The obligations, in plain terms

Canadian federal privacy law is built on a set of principles rather than a checklist, and three of them matter most here.

Openness. People should be able to find out what you collect and why.

Consent. Collection should be with knowledge and consent, and what counts as adequate depends on how sensitive the information is.

Limiting collection. Collect what you need for a stated purpose, and not more.

For ordinary website analytics on a small business site, a clear privacy policy and proportionate collection is the substance of it.

Anything unusual, or anything involving genuinely sensitive information, is worth taking proper advice on rather than reasoning from general principles yourself.

The privacy policy

The main practical requirement, and the place most small sites fall short by copying somebody else's.

What it should say: that you use analytics, which service, what it collects in general terms, why, how long you keep it, and who else sees it.

Also how somebody can opt out of it, and a real named contact for any questions.

The common failure is a copied policy describing practices the business does not have, mentioning cookies it does not set and services it does not use.

That is worse than a short honest one, because it is a statement you cannot support and it suggests nobody has thought about any of it.

Reducing what you collect

• Turn on address anonymisation, which truncates the visitor's network address.
• Shorten the retention period from the default.
• Do not send personal information in page addresses or event names.
• Turn off features you do not use, particularly advertising ones.
• Remove scripts you are not using.

The third catches people out. A form that puts an email address into the page address after submission is sending that address into your analytics, which is a genuine problem and entirely avoidable.

A worked example

A business reviewing its site after a customer asked what it collected.

Analytics was installed, which they knew about. They also found an advertising pixel from a campaign in 2018, a heatmap tool trialled and abandoned, and a chat widget nobody had answered in a year.

All three were collecting information about visitors, none was disclosed in the privacy policy, and nobody in the business had known they were there.

Removing them took twenty minutes.

Rewriting the privacy policy to describe what actually happened took an hour.

The page also got noticeably faster, which was an entirely unintended benefit of the same afternoon of work.

The cookie notice question

Handled differently in different places, which is why the advice conflicts.

European rules require consent before setting non-essential cookies, which is why so many sites now open with a banner.

Canadian requirements are framed around meaningful consent rather than a specific banner, and for ordinary analytics a clear, findable notice is generally the expectation rather than a blocking pop-up.

A business with European visitors is in a different position and should take advice on it.

What is not acceptable anywhere is a banner that says cookies are being used and provides no way to decline anything, which is a notice pretending to be a choice.

The counter-case

Where analytics is not worth installing.

A site with very low traffic, where the numbers are too small to mean anything and the enquiry log is a better record.

A business that will never look at it, where installing a tracking script to gather data nobody reads is collection without a purpose, which is precisely what the principles discourage.

And a placeholder or a single-page site with nothing to measure.

In each of those cases, not installing it is the simplest way to comply with everything at once, and it removes both a page weight and a disclosure obligation.

The lighter alternatives

Worth knowing about, because the full product is more than most small businesses need.

Several analytics services collect substantially less, set no identifier on the visitor's device, and report the handful of numbers a small business actually uses.

They typically cost a small monthly amount, where the large one is free, which is the trade.

What you get for it: a simpler disclosure position, a much lighter page, and reports that are readable without training.

For a business that wants to know how many people visited and what they read, that is frequently a better fit than a product designed for advertising measurement.

Who else can see the data

A question worth answering before writing the policy, since the answer belongs in it.

The analytics provider holds the data, on their servers, frequently outside Canada.

Anybody you have granted access to: a designer, an agency, a former supplier who was never removed.

And anybody with access to the account it sits under, which for a small business is usually a personal account rather than a business one.

Two practical consequences. The policy should say that data is processed by a third party and may be stored outside Canada, because that is a disclosure people expect.

And the access list is worth auditing on the same schedule as everything else, because analytics access is one of the things nobody removes when a relationship ends.

Setting it up properly

1. Decide what you will actually look at.
2. Install one analytics tool, not three.
3. Turn on anonymisation and shorten retention.
4. Write a privacy policy describing what really happens.
5. Audit every other script on the site.
6. Remove anything nobody uses.

The fifth and sixth produce most of the improvement on most small sites, because the exposure is rarely the analytics and usually the four forgotten things alongside it.

How to find those scripts is covered in how many things a page loads.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.