GDPR-friendly link analytics, explained
“Analytics” and “privacy” are often treated as opposites. For link tracking, they don’t have to be.
What you actually need to know
For most teams, useful link analytics is: how many clicks, over time, from which countries, via which referrers, and roughly how many unique visitors. None of that requires following a person around the web.
The cookie myth
Cross-site cookies and device fingerprinting exist to build profiles across properties — that’s what triggers consent banners under the GDPR and the Swiss nLPD. Counting a click server-side does not. When the redirect happens, the server already sees the request; aggregating it into a count is ordinary first-party processing.
How Einblik does it
- Clicks are counted server-side at redirect time — we set no cookies at all, so there’s no consent banner to bolt on.
- To count unique visitors we derive a key by hashing the link, IP and user-agent with a secret salt that rotates every day and is then deleted. The same visitor is counted once within a day; the next day the key changes and the old salt is gone, so no one can be linked across days — we genuinely can’t recognise returning visitors, by design.
- We derive coarse signals — country (from IP), browser/OS family, language.
- Data is processed in Switzerland.
- A DPA is available for Team customers, and aggregated retention windows keep raw data short-lived.
The result: genuinely useful dashboards, no consent banner to bolt on, and a privacy story you can stand behind.