Chykalophia Docs

A plain-English guide to how website tracking works, what cookies do, what privacy laws require, and how Chykalophia sets up tracking in a compliant way.

Website tracking and privacy are topics that affect every website owner. Regulations like GDPR in Europe and similar laws elsewhere mean that how you collect data from visitors has legal implications. This guide explains the essentials in plain English.

Quick summary

Tracking tools like Google Analytics use cookies to collect data about website visits without identifying people by name. Privacy laws (the UK and EU cookie rules, GDPR, CCPA and others) require you to inform visitors about this and, in many cases, get their consent before tracking begins. Chykalophia handles the technical setup, but you are the legal owner of your website's data practices.

A cookie is a tiny text file that a website saves in your visitor's browser. Cookies are used for many purposes — keeping people logged in, remembering shopping cart contents, and tracking visits for analytics.

For analytics purposes, cookies typically store a randomly generated ID. Google calls this the client ID, and it identifies a browser rather than a person. When the same visitor returns, the cookie lets GA4 recognise that this is the same browser that visited before — without knowing who that person actually is.

Types of tracking

Not all tracking is the same:

Type	What it does	Consent required?
Strictly necessary	Keeps the site working (logins, shopping carts)	No
Analytics	Counts visits and measures how the site is used	UK: a narrow exception may apply — see below. EU: usually yes
Marketing	Tracks people for advertising and retargeting	Yes
Preferences	Remembers settings like language	UK: may fall under the "appearance" exception. EU: usually yes

The UK exceptions are narrow and conditional. Even where one applies, you still have to give visitors clear, comprehensive information about what you are doing and a simple, free way to object.

What privacy laws apply?

The laws vary by region, but the most important ones to know:

The cookie rules: PECR (UK) and the ePrivacy Directive (EU) — often called the "Cookie Law." These, rather than the GDPR itself, are the rules about storing information on a visitor's device or reading information already there. The UK version changed under the Data (Use and Access) Act, and the ICO published new guidance in 2026 that sets out five narrow exceptions, one of which covers statistics collected purely to improve your own site.

GDPR (EU) and UK GDPR — these set the standard for what counts as valid consent: "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement." They also govern what you must tell people about the personal data you collect.

CCPA and CPRA (California) — the California Consumer Privacy Act, as amended, gives California residents the right to know what personal information a business collects about them, to have it deleted or corrected, and to opt out of its sale or sharing.

The EU GDPR can reach you even if your business is not in the EU. It applies to organisations outside the EU where they offer goods or services to people in the EU, or monitor the behaviour of people in the EU. Simply having an EU visitor now and then is not the test; what you do with your site is.

This is not legal advice

This article explains the concepts. Your legal obligations depend on your specific business and where your visitors are located. For formal compliance advice, consult a legal professional.

Consent means a visitor knowingly and actively agreed to have non-essential cookies placed on their device. This must be:

Freely given — they need a genuine choice. The ICO says that in most cases, blocking access unless someone accepts does not give them one
Informed — they must be told what you want to use, what it does and why, before they agree
Specific — they should be able to accept analytics cookies without also accepting marketing cookies
Unambiguous — it takes a clear, positive action. Carrying on browsing is not consent, and neither is a pre-ticked box
As easy to refuse as to accept — and as easy to withdraw later as it was to give in the first place

You also must not set non-essential cookies before the visitor has agreed, and you have to name any third parties whose cookies you are asking them to accept.

How we handle this on your site

Chykalophia typically installs a cookie consent banner — a pop-up or bar that appears the first time someone visits your site. It explains what cookies are used, lets visitors accept or decline, and respects their choice.

We configure Google Tag Manager to only fire analytics and marketing tags after a visitor has consented. Where tags are held back like that, GA4 collects nothing at all from a visitor who declines. A site set up with Google's consent mode behaves differently — the tags still load, store no cookie and send a cookieless ping instead. See the question below, and cookie consent & banners explained, for what each setup does to your numbers.

Read more about the banner itself in our cookie consent guide.

What about privacy-friendly analytics?

Some businesses prefer analytics tools that do not use cookies at all — these collect aggregate data without storing anything in the visitor's browser. We can discuss alternatives if privacy compliance is a priority for your business.

Common questions

Yes, if your site uses any non-essential cookies (including analytics). Your privacy policy should explain what cookies you use, why, and how visitors can manage them.

What happens to my analytics if visitors decline cookies?

Where analytics tags are held back until someone consents, a visit from someone who declines is not counted at all. So some visits will be missing from your reports. How many depends on your audience and your banner; measure it from your own consent records rather than assuming a percentage. If your setup instead uses Google's consent mode, tags that fire without consent do not store cookies — they send cookieless pings, and Google models part of the missing data.

GA4 can be used in a GDPR-compliant way when paired with proper consent management. Google has built privacy measures into the product: it states that IP addresses are not logged or stored, and that data from EU, Swiss and UK devices is collected through domains and servers in those regions before being processed. Compliance still depends on your own setup and your consent management approach, so this is not something Google can hand you ready-made.

What is 'IP anonymisation'?

It was a Universal Analytics setting that trimmed the last part of a visitor's IP address before storing it. There is nothing to switch on in Google Analytics 4. In Google's words, "IP masking is not necessary since IP addresses are not logged or stored." Analytics still derives a rough location from the IP address — city, region, country — and for EU, Swiss and UK traffic it discards the address immediately afterwards.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

Tracking, cookies & privacy