GDPR lawful-basis considerations for web-analytics processing operate within the substantive framework that the European Data Protection Board and the national supervisory authorities have progressively documented through guidance and enforcement actions. The framework merits closer developer-portal reading than the operator-tool-comparison literature typically provides.
The lawful-basis framework architecture
The GDPR establishes six lawful-basis categories that processing operations can rely on: consent, contract, legal obligation, vital interests, public task, and legitimate interests. For web-analytics processing, the principal lawful-basis options are consent and legitimate interests, with the substantive considerations between the two being one of the principal lawful-basis-selection decisions.
The consent-based approach
The consent-based approach to web-analytics processing requires the consent-collection methodology specified by the ePrivacy Directive for cookie-and-storage operations, combined with the GDPR-consent-quality requirements that apply to the broader processing operations. The consent-based approach produces the highest-quality lawful-basis reliance but produces the operational friction of the consent-collection workflow.
The legitimate-interests approach
The legitimate-interests approach to web-analytics processing requires the substantive legitimate-interests-assessment methodology that the GDPR framework specifies — the three-part test of legitimate-purpose identification, necessity-assessment, and balancing-test against data-subject interests. The legitimate-interests approach is methodologically more complex than the consent-based approach but can support processing operations that the consent-based approach does not adequately cover.
The substantive legitimate-interests-assessment work for web-analytics processing requires explicit documentation of the legitimate-purpose, the necessity-assessment, and the balancing-test outcome. The supervisory-engagement work that the framework-supervisory authorities perform may require the legitimate-interests-assessment documentation, with the resulting documentation-quality being part of the framework-compliance reality.
