Adding a visitor counter means processing some information about the people who visit your website. That brings responsibilities: telling visitors what you collect, keeping only what you need and, in many countries, asking for consent before non-essential tracking starts. This guide explains in plain language what data analytics tools use, how cookies and consent work and what a small website owner should do. It is general information, not legal advice; the rules that apply to you depend on where you and your visitors are.
What data a visitor counter processes
To count visits and build reports, a counter typically receives:
- The page address and title of the page being viewed.
- The referrer, the page that linked to yours, if the browser provides it.
- Technical browser details, such as the browser, operating system, language and screen size.
- The IP address, which is needed to deliver any web request and is used to estimate the visitor’s country.
- A visitor identifier, usually stored in a cookie, so the counter can tell a returning browser from a new one.
- The time of each page view.
Several of these items, especially IP addresses and identifiers stored on a device, are treated as personal data under laws such as the GDPR in the European Union, the UK GDPR and Türkiye’s KVKK. That is why analytics is a privacy topic even when you never see visitors’ names.
Cookies in plain language
A cookie is a small piece of text that a website stores in the browser. Cookies are used for many purposes:
- Strictly necessary cookies make a site work, for example keeping a shopping basket or remembering a consent choice.
- Preference cookies remember settings such as language.
- Analytics cookies help count visitors and understand how a site is used.
- Advertising cookies are used to select, show and measure ads, sometimes across many websites.
Cookies set by the site you are visiting are first-party cookies. Cookies set by other domains loaded on the page, such as ad networks, are third-party cookies. GNRCounter’s visitor identifier is a first-party cookie set on your own domain, and it is used to recognise a returning browser for your statistics. A separate cookie stores your choice if you exclude your own browser from counting with ?gnrc-hideme=1.
When consent is required
In the EEA and the UK, the ePrivacy rules generally require consent before storing or reading information on a visitor’s device, unless it is strictly necessary for a service the visitor requested. Analytics cookies are usually not considered strictly necessary, so consent is commonly required. Some supervisory authorities allow narrow exemptions for limited, privacy-friendly audience measurement, but the conditions are strict and vary by country.
Other regions take different approaches. Several US states, for example, focus on the right to opt out of the sale or sharing of personal data and of targeted advertising, while Canada’s laws emphasise meaningful consent and transparency. Türkiye’s KVKK requires a clear information notice and, depending on the processing, explicit consent. If your audience is international, the strictest rules that apply to your visitors are a sensible baseline.
What good consent looks like
- Before tracking: non-essential cookies and scripts should not run until the visitor agrees.
- Equal choice: rejecting should be as easy as accepting, without hidden buttons or confusing wording.
- Specific and informed: visitors should understand what they agree to and which providers are involved.
- Easy to change: a link such as “Cookie preferences” in the footer should let visitors change their mind at any time.
- No pre-ticked boxes: silence or continued browsing is not consent under the GDPR.
If your site shows Google ads to visitors in the EEA, the UK or Switzerland, Google requires a certified consent management platform. Google offers its own consent message in the privacy and messaging settings of its ad products.
Writing your privacy notice
Your privacy notice should explain, in language your visitors understand:
- Who runs the website and how to contact you.
- Which tools you use, including your visitor counter, analytics, embedded content and advertising.
- What data each tool processes and why.
- Which cookies are set and for how long.
- Who receives the data, including service providers and any transfers to other countries.
- How long data is kept.
- Visitors’ rights, such as access, deletion and objection, and how to exercise them.
- How visitors can give, refuse or withdraw consent.
GNRCounter’s own privacy policy describes the data the counter processes and can help you describe it accurately in your notice. As the owner of the website where the counter is installed, you remain responsible for your own notice and for any required consent.
Privacy-friendly analytics habits
- Collect less: install analytics only where you need it and avoid adding several tools that measure the same thing.
- Keep personal data out of URLs: never put names, email addresses or ID numbers in page addresses or query parameters, because addresses are recorded in statistics.
- Protect access: treat private dashboard and management links like passwords. Share public report links only when you intend the figures to be public.
- Think before showing visitor details: a visible counter can show each visitor their own IP address. Some visitors find that unsettling, so use it only if it suits your audience.
- Review regularly: remove tools you no longer use and update your notice when you add new ones.
Hidden does not mean anonymous
An invisible counter records the same data as a visible one; it simply does not draw a display on the page. The same notice and consent rules apply. Our guide to visible vs invisible counters explains the difference in more detail.
Frequently asked questions
Do I need a cookie banner for a simple counter?
If your visitors include people in the EEA or the UK, you will usually need consent for analytics cookies. Elsewhere, requirements differ. In all cases, a clear privacy notice is expected.
Is an IP address personal data?
In the EU, the UK and many other places, IP addresses are generally treated as personal data because they can be linked to a person or household.
Will consent reduce my visitor numbers?
Visitors who decline are not counted by tools that respect their choice, so recorded figures can drop. Trends remain useful as long as you compare periods with the same setup.
Can visitors ask me to delete their data?
Under many privacy laws, yes. Explain in your notice how visitors can contact you, and respond within the time limits that apply.
Next steps
List the tools on your website, check that your privacy notice mentions each one and make sure consent works before non-essential tracking starts where required. When you are ready to measure, create a free counter and follow the installation guide. For more topics, see all guides.