Configuration Guide

etracker analytics is a German web analytics platform developed by etracker GmbH (Hamburg, Germany). It deploys a JavaScript tracking code on customer websites and is distinguished by its privacy-by-design architecture: in its standard cookie-less mode, it operates without the analytical cookies that typically trigger consent requirements under the GDPR and TDDDG. Depending on configuration, etracker can operate as a fully consent-free session analytics tool or as a more capable cross-session and cross-device analytics platform with personalisation and ad conversion integration. The configurations below cover the most privacy-relevant settings and their corresponding mappings in the Customer Panel (CP).

Important note on data location: etracker GmbH is a German company. All data is processed exclusively on etracker's own servers in Hamburg, Germany, hosted at the ISO/IEC 27001-certified IPHH Internet Port Hamburg GmbH data centre. etracker explicitly states that no data is transferred to the USA and that access by US government authorities under the CLOUD Act is excluded. Accordingly, no US processing location is indicated for etracker itself in this guide. This distinguishes etracker from US-based analytics providers and is a relevant factor in the consent banner and privacy policy.

---

Step 1 — etracker Configuration

Configuration A — Low Risk

Use this configuration when etracker is used solely for anonymous, consent-free website analytics under the legal basis of legitimate interest. In its standard cookie-less mode, etracker does not set any analytical cookies. The only storage mechanisms in use are session storage entries (for scroll depth measurement and tag manager caching), which are automatically cleared when the browser tab is closed and contain no persistent identifiers. The IP address is truncated at the earliest point in the data acceptance process before any storage occurs. There is no cross-session or cross-device visitor recognition.

This mode has been independently audited by ePrivacy GmbH, which confirmed that use of etracker analytics in cookie-less standard mode is lawful without any consent requirement under the GDPR and TDDDG. A data processing agreement (DPA) is automatically concluded with etracker upon account creation.

Note on the consent banner: Because Configuration A does not involve consent-required processing by etracker itself, it does not technically need to appear in a consent category requiring opt-in. It must, however, be disclosed in the privacy policy, and an opt-out option must be provided. If you choose to include it in your consent banner for transparency reasons (e.g. as a legitimate interest entry), map it as described in Section 2.1 below. The opt-out text and link are available directly in the etracker account under Data protection → Data protection notice.

Configuration B — Medium Risk

Use this configuration when etracker is used for website analytics with cross-session visitor recognition. Consent is required and must be obtained before the analytical cookie is set. The tracking code must include data-block-cookies="true", and the _etracker.enableCookies() API call must be triggered only after the user's consent has been recorded. Upon consent, etracker sets the _et_coid first-party cookie (stored in local storage), which assigns a pseudonymous identifier to the visitor's browser, enabling recognition across sessions. The cookie lifetime is set to 6 months via the data-cookie-lifetime="6" attribute. IP anonymisation remains active by default. No cross-device tracking or personalisation is in use. Data is processed exclusively in Germany by etracker GmbH as data processor under its DPA.

Configuration C — Higher Risk

Use this configuration when etracker is used for full cross-session and cross-device analytics combined with on-site personalisation and server-side advertising conversion reporting. Consent is required for all components before activation. In addition to the _et_coid analytical cookie, cross-device tracking is enabled, which links visitor sessions across different devices using authentication-derived identifiers (e.g. a unique link in a newsletter or a website login). The Targeting API is activated to personalise website content in real time based on stored visitor history (held in the BT_pdc cookie). Cookie lifetime is set to 24 months.

Server-side ad connectors (e.g. Google Ads, Meta Ads) are enabled to transmit conversion data to the respective advertising platforms via server-side API calls. These platforms are independent controllers operating under their own terms, policies, and data locations. Each must be configured as a separate entry in the Customer Panel. As these are US-based enterprises, their processing is potentially subject to access by US government authorities under the CLOUD Act, and this must be disclosed in the consent banner for each platform individually.

etracker GmbH itself continues to process data exclusively in Germany as a data processor. The CLOUD Act does not apply to etracker.

---

Step 2 — Mapping in the Customer Panel

Using the etracker configurations defined in Step 1, apply the following mappings in the Customer Panel to ensure the consent banner correctly reflects the data processing activities.

2.1 Configuration A — Low Risk

Note: Configuration A operates under legitimate interest and does not require opt-in consent for etracker itself. If you choose to surface it in the consent banner for transparency purposes, map it as shown below, clearly indicating the legitimate interest legal basis.

2.2 Configuration B — Medium Risk

2.3 Configuration C — Higher Risk

This configuration requires a separate Customer Panel entry for etracker and for each connected advertising platform, as the ad platforms operate as Independent Controllers under their own terms.

etracker (Processor entry):

Connected ad platforms — configure a separate entry for each (e.g. Google Ads, Meta Ads):

Note: Advertising platforms such as Google Ads and Meta Ads operate as Independent Controllers under their own terms and privacy policies. Each platform must be listed as a separate data recipient in the Customer Panel, and the consent banner must surface appropriate information about data sharing with each platform individually. As these are US-based enterprises, the CLOUD Act risk applies to each and must be disclosed as a potential US data transfer, irrespective of where the data is physically stored.