GDPR, CCPA and PIPL: what they mean for analytics

The three laws in one paragraph each

• GDPR — the EU General Data Protection Regulation. Every processing needs a legal basis (consent, legitimate interest and others); people have rights of access, erasure, objection and portability; transfers outside the EU need safeguards. Cookie rules come from the separate ePrivacy rules.
• CCPA / CPRA — the California Consumer Privacy Act as amended. Built around notice and opt-out: people can see what is collected, ask for deletion and opt out of "sale or sharing", which covers much cross-context advertising. Browsers' Global Privacy Control signal must be honoured.
• PIPL — China's Personal Information Protection Law. Closer to GDPR, with a strong emphasis on separate consent for sensitive data and cross-border transfer, and fixed time limits for handling requests.

What they mean for analytics

• Minimise. Collect what you use. Do not put emails or names in event properties.
• Know your basis. Decide whether analytics runs on consent or on another basis, region by region.
• Tell people. The privacy policy should say what analytics collects and why.
• Honour rights. Be able to find, export and erase a person's data, and to stop collecting it.
• Limit retention. Keep detailed event data only as long as it is needed.

This page summarises common principles, not legal advice; requirements depend on your business and jurisdiction.

How TapCub maps to them

TapCub's compliance centre configures privacy per site and per visitor region (EU / EEA, UK, California, the rest of the US, mainland China and others). Settings include the collection tier, whether consent is required before collection, honouring Global Privacy Control and Do Not Track, IP truncation, stripping personal data from event properties, element-text capture and retention per data type.

Four regional presets — CNIL exemption, UK statistics exception, German DSK basic counter and GDPR full consent — apply a known configuration and lock it. China mode (PIPL) requires consent before collection and caps the cooling-off period for erasure requests. Data subject requests for access, portability, erasure and restriction are handled in the console, with an audit log of configuration changes and requests.

Common mistakes

• Assuming "anonymous" because there are no names. IP addresses and device IDs are personal data under GDPR.
• One setting for the whole world. Consent rules differ by region; configure by region.
• Keeping everything with no time limit. Retention limits are both a legal requirement and a security measure.

Related guides: GDPR-Compliant Analytics and First-Party Data Strategy. See also keep personal data out of analytics.