Using Plausible Analytics in a privacy-compliant way

Plausible (plausible.io) measures reach without cookies, hosts in the EU and states that it does not permanently store personal data. The IP address is processed briefly to form an anonymous daily hash.

Is this a risk?

Without access to the device beyond the technically necessary delivery, § 25 TDDDG usually does not apply, so many operators use Plausible without a consent banner. That is not a free pass: it remains processing under the GDPR that needs a legal basis (usually Art. 6 (1)(f)), an entry in the record of processing activities and a mention in the privacy policy. When self-hosting, responsibility lies entirely with you.

What you can do

• Check that the integration really is cookieless and that no additional script sets identifiers.\nList Plausible in the record of processing activities and briefly weigh and document the legitimate interests.\nIn the privacy policy, describe the purpose, EU hosting, brief IP processing and right to object.\nWhen using plausible.io, conclude a data processing agreement.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.