Free tool Privacy compliance checklist for analytics: GDPR, CCPA and PIPL
Analytics, chat widgets and ad pixels are where most websites collect personal data without thinking about it. This checklist turns three privacy laws into concrete checks for those tools, marks which ones the law requires and which are good practice, and links every item to the article it comes from.
- Three laws, cited article by article
- Must / should for every item
- Progress stays in your browser
Work through the checklist
Pick a law, tick what you have done and mark what does not apply to you. The progress bar counts only items that apply.
Must: stated in the law or its binding regulations (some only apply in the situation the item describes). Should: regulator guidance, case law interpretation or good practice.
GDPR (EU)
18 items
Applies when you are established in the EU, or offer goods or services to or monitor people in the EU (Art. 3). The ePrivacy rules on cookies apply alongside it.
-
List what you measure — traffic, conversions, chat transcripts, ad attribution — and give each a basis under Art. 6(1), usually consent (a) or legitimate interests (f). Legitimate interests needs a documented balancing test.
-
Cookies, localStorage, pixels and SDK identifiers need prior consent unless they only carry a transmission or are strictly necessary for a service the user explicitly asked for. Check what each analytics, chat and ad tag stores before the banner is answered.
-
Consent must be freely given, specific, informed and unambiguous, by a clear affirmative action. Pre-ticked boxes are not valid, and the information must include how long cookies last and whether third parties can access them.
-
Most EU regulators treat a banner with no reject option on the first layer as a breach, and look at colours and contrast that push towards accepting. The French CNIL requires refusing to be as easy as accepting.
-
Keep a link or icon that reopens the consent settings on every page, and stop the affected tags as soon as consent is withdrawn.
-
Store when consent was given, for which purposes and which version of the notice was shown, so you can demonstrate it later.
-
Identity and contact, DPO contact, purposes and legal basis, legitimate interests, recipients (name your analytics and chat vendors), transfers, retention period, rights, withdrawal, complaint to a supervisory authority, whether data is required, automated decision-making.
-
Analytics, chat, email and hosting providers acting for you need a contract covering your instructions, confidentiality, security, sub-processors, assistance with requests and deletion at the end.
-
For vendors outside the EEA, rely on an adequacy decision — for the US, only companies certified under the EU-US Data Privacy Framework (decision of 10 July 2023) — or on standard contractual clauses.
-
Decide how long events, chat transcripts and consent logs are kept, state the periods in the notice, and check that each tool actually deletes on schedule.
-
Be able to find, export, correct and delete one person's data in every tool. The deadline can be extended by two further months for complex requests if you tell the person within the first month.
-
List purposes, data categories, recipients, transfers, retention and security measures. The exemption for organisations under 250 people does not cover processing that is not occasional, such as continuous web analytics.
-
Encryption in transit, role-based access, pseudonymisation such as truncated IP addresses, and regular testing of the measures.
-
Notify the supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk, and inform the people affected when the risk is high.
-
Applies when you are outside the EU but offer goods or services to, or monitor the behaviour of, people in the EU. Occasional, low-risk processing is exempt.
-
Strip emails, phone numbers and user IDs from page URLs and event properties, truncate IP addresses, and switch off fields you never report on.
-
The EDPB considers that Art. 5(3) can also cover tracking pixels, identifiers in URLs and similar techniques that read from the device without classic cookies. Do not assume a "cookieless" tag is exempt; check what it reads.
-
Required when processing is likely to result in a high risk, such as large-scale profiling or systematic monitoring. Write down the assessment even when the answer is no.
CCPA / CPRA (California)
16 items
Applies to for-profit businesses doing business in California that meet one of the thresholds in the first item. California's CalOPPA covers any commercial site collecting personal information from California residents.
-
A for-profit business doing business in California is covered if it meets one threshold: annual gross revenue above $26,625,000 (the adjusted figure from 1 January 2025), buying, selling or sharing personal information of 100,000+ consumers or households a year, or earning 50% or more of revenue from selling or sharing it.
-
At or before collection, list the categories of personal and sensitive personal information, the purposes, whether each is sold or shared, and how long each category is kept.
-
Describe consumer rights and how to use them, and the categories collected, sold, shared or disclosed. Review it at least once every 12 months.
-
"Sharing" means disclosing personal information for cross-context behavioural advertising, which covers many ad and retargeting pixels. If you sell or share, add a "Do Not Sell or Share My Personal Information" link, or use the opt-out preference signal route.
-
Treat a GPC signal as a valid request to opt out of selling and sharing for that browser, and for the consumer if you know who they are. Ad and retargeting tags must stay off for that visitor.
-
Stop selling or sharing no later than 15 business days after receiving the request, and pass it on to third parties that received the data in the meantime.
-
Provide at least two ways to submit requests to know, delete and correct, including a toll-free number unless you operate only online and have a direct relationship with consumers (then email is enough). Reply within 45 days; one 45-day extension is allowed with notice.
-
Contracts with service providers and contractors (analytics, chat, hosting) and with third parties you sell or share data with must contain the terms the statute and regulations list.
-
If you use sensitive personal information such as precise geolocation or account log-ins beyond the permitted purposes, offer a "Limit the Use of My Sensitive Personal Information" link.
-
If you know a consumer is under 16, you may not sell or share their data unless they opt in (ages 13–15) or a parent or guardian does (under 13).
-
No different prices, service levels or refusals because someone opted out or made a request. Financial incentives need a notice and must be reasonably related to the value of the data.
-
Required by the statute; breaches caused by a failure to do so can lead to consumer lawsuits with statutory damages.
-
Request and consent flows must be easy to understand, offer symmetrical choices and avoid dark patterns. Agreement obtained through a dark pattern is not consent.
-
Log each consumer request and how you responded, and keep the records for at least 24 months.
-
California's CalOPPA requires a commercial website collecting personal information from California residents to disclose in its privacy policy how it responds to browser "do not track" signals.
-
Turn on Global Privacy Control, reload your site and confirm ad and retargeting tags no longer fire. The browser privacy check shows whether GPC is on.
PIPL (China)
20 items
Applies to processing in mainland China, and to processing abroad that provides products or services to, or analyses the behaviour of, people in China (Art. 3).
-
Consent, or one of six other grounds such as performing a contract with the individual. Analytics or in-app tracking that identifies individuals usually relies on consent.
-
Name and contact of the personal information handler; purposes, methods, categories and retention period; how to exercise rights. Tell people about changes, and keep the rules public and easy to read and save.
-
No default-agreed privacy policy checkbox. New purposes, methods or categories need new consent. China's 2019 app enforcement criteria treat default consent as collecting without consent.
-
For example a switch in settings. Withdrawal stops future processing based on that consent.
-
Unless the personal information is necessary to provide the product or service.
-
An analytics, chat or cloud provider processing for you needs an agreement on purpose, period, method, categories, protection measures and each side's obligations, and you must supervise it.
-
Tell people the recipient's name, contact, purpose, method and categories. Third-party code or SDKs in your app that send data straight to a third party count, unless the data is anonymised.
-
Sensitive personal information — including precise location, financial accounts and any data of children under 14 — needs separate consent and a notice of necessity and impact. Under-14s need a parent's or guardian's consent and dedicated rules.
-
If data leaves mainland China, for example to an analytics service hosted abroad: tell people about the overseas recipient and get separate consent; use a security assessment, standard contract or certification unless exempt (fewer than 100,000 people's non-sensitive data since 1 January of the year). Exempt transfers still need notice, separate consent and an impact assessment.
-
The retention period must be the shortest needed to achieve the purpose.
-
Set up a convenient way to receive and handle requests, and give reasons when you refuse one.
-
Internal rules, classification, encryption and de-identification, access control, staff training and an incident response plan.
-
Before processing sensitive data, automated decision-making, entrusting, providing or publishing data, transferring it abroad and other high-impact processing. Keep reports for at least three years.
-
Take remedial action at once and notify the responsible authorities and the affected individuals; individuals need not be notified if the measures effectively prevent harm.
-
Handlers processing personal information of 1 million or more people must appoint an officer; the CAC's July 2025 notice requires the officer's details to be filed.
-
Overseas handlers covered by Art. 3(2) must set up a dedicated entity or appoint a representative in China and report it.
-
Push messages and marketing based on automated decision-making must also offer options not based on personal characteristics, or an easy way to refuse.
-
Prompt users to read the privacy policy at first run, keep it within four taps of the main screen, and handle correction, deletion and complaints within 15 working days.
-
Since 17 October 2023, privacy-related APIs fail unless the user privacy protection guide is filled in in the mini program admin console and the user has agreed through the privacy authorisation flow.
-
China's recommended national standard on personal information security gives detailed guidance on privacy policy content, consent, rights and entrusted processing. It is not mandatory, but is widely used as a reference in app reviews.
Ticks are saved only in this browser (localStorage key tc_checklist), written when you tick an item and removed when you clear them. Nothing is uploaded.
Version v1.0Updated Update history
What the progress bar does and does not tell you
The bar counts checked items, nothing more. Four things to keep in mind when you read it.
Not a score
There is no pass mark. 100% means you have looked at every item and marked it done or not applicable; it says nothing about whether a regulator would agree.
Must items first
Start with the "Must only" filter. Many must items are conditional, for example the EU representative or minors: mark them not applicable when the condition does not apply to you, and note why.
Several laws at once
A site with EU, Californian and Chinese visitors needs all three lists. Many items overlap — notice, retention, vendor contracts — so one piece of work can tick several boxes.
Keep the export
The Markdown or CSV file is a dated record of what you checked. Store it with your records of processing and repeat the check when you add a tool or a market.
Laws and guidance change. The items were checked against the official texts on the date shown at the top of the page; the source links let you re-check any item yourself.
Four steps to a usable record
Plan about an hour per law the first time, mostly spent looking up what your tags actually do.
-
1
List your tools
Write down every script and SDK on the site or app: analytics, chat, ad pixels, A/B testing, email forms. The checks are about what these collect.
-
2
Pick the laws
Choose the tab for each place your visitors come from. Read the scope note at the top of each list.
-
3
Tick or mark N/A
Follow the source link when an item is unclear. Use "Not applicable" only when the condition in the item really does not apply.
-
4
Export and assign
Download the CSV, give each open item an owner and a date, and keep the Markdown file as your dated record.
Where the items come from
Each item is tied to a specific provision in the law, its binding regulations or official guidance, read in the original. Items are written for websites and apps that use analytics, chat and advertising tags, not for every kind of processing.
- Must = stated in the law or binding regulations; Should = regulator guidance, case law or good practice
- Progress = done ÷ (all − not applicable), per law
- Sources checked against the official texts on the page's update date
| Law | Primary text | Also used |
|---|---|---|
| GDPR | Regulation (EU) 2016/679, EUR-Lex | ePrivacy Directive Art. 5(3); CJEU Planet49; EDPB Guidelines 05/2020 and 2/2023; Cookie Banner Taskforce report; CNIL 2020-092 |
| CCPA / CPRA | Cal. Civ. Code §1798.100 ff. | CCPA Regulations (Cal. Code Regs. tit. 11 §7000 ff.); CPPA threshold adjustment; CalOPPA §22575 |
| PIPL | Personal Information Protection Law (2021), NPC | Cross-Border Data Flow Provisions (2024); App Determination Method (2019); CAC notice 2025; WeChat privacy guide; GB/T 35273-2020 |
One site, three lists
A shop based in Germany sells to the EU and the US, has a Chinese mini program, runs web analytics, a chat widget and two ad pixels. How a few items play out.
| Item | Decision | Status |
|---|---|---|
| GDPR: consent before storing on the device | Ad pixels wait for consent; the cookieless analytics script stores nothing | Done |
| GDPR: EU representative | The company is established in Germany | Not applicable |
| CCPA: does it apply? | Revenue below the threshold, but more than 100,000 Californian visitors a year are shared with ad platforms | Applies |
| CCPA: honour GPC | Ad pixels suppressed when the browser sends GPC; tested in Firefox | Done |
| PIPL: cross-border transfer | Mini program data stored in a mainland China region; nothing transferred | Not applicable |
| PIPL: WeChat privacy guide | Guide filled in; agreement popup added before location API | Done |
The decisions are illustrative. The threshold question in particular needs your own visitor and revenue numbers.
Where analytics setups usually fail
These show up again and again in regulator decisions and audits.
Tags firing before the banner is answered
Ad pixels and analytics that set cookies on page load defeat the banner. Check the network tab on a fresh visit.
No reject on the first layer
"Accept" in a big button and "settings" in small text is what the EDPB taskforce and CNIL decisions targeted.
Vendors missing from the notice
Each analytics, chat and ad vendor is a recipient. Generic "partners" wording does not tell people who gets their data.
Forgetting transfers
A dashboard hosted abroad is a transfer under both GDPR and PIPL, even if your own servers are local.
Analytics that makes several items easier
TapCub does not make you compliant — no tool can — but its defaults remove some of the work on this list.
Nothing stored on the device by default
The analytics script writes no cookies or local storage in its default mode, so it does not need device-storage consent. Whether the processing needs consent still depends on your setup and local law.
Learn moreGPC and Do Not Track honoured
By default the script does not load when either signal is on, and the server treats hits carrying the headers as anonymous aggregate data.
Learn moreCompliance centre and data regions
Consent records, one-person lookup, export and deletion, a China mode for PIPL, and a stated data region per project.
Learn moreCompliance checklist questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What should a GDPR compliance checklist for analytics include?
A lawful basis per purpose, consent before non-essential cookies or device access, a banner with an equal reject option, easy withdrawal, records of consent, a notice covering Art. 13, processor contracts, transfer safeguards, retention limits, a process for data subject requests and breaches, and records of processing. All are in the GDPR tab above.
Does completing this checklist make my site compliant?
No. It is a structured self-check based on the legal texts. Compliance depends on facts the checklist cannot see, and a regulator or court may read a provision differently. Have a lawyer review your setup.
Does the CCPA apply to my business?
Only if you are a for-profit business doing business in California and meet one threshold: revenue above $26,625,000 (from 1 January 2025), buying, selling or sharing data of 100,000+ consumers or households a year, or 50%+ of revenue from selling or sharing data. CalOPPA's privacy policy rules apply more widely.
What is the difference between GDPR and PIPL for analytics?
Both require notice, a legal basis and rights handling. PIPL puts more weight on separate consent (for sharing with other handlers, sensitive data and cross-border transfers) and has its own transfer regime. GDPR is paired with the ePrivacy rules on cookies, which PIPL has no direct equivalent of.
Do I need a cookie banner for cookieless analytics?
For device storage, a script that stores nothing is not caught by ePrivacy Art. 5(3). But the EDPB says the rule can cover other techniques that read from the device, and the processing itself still needs a lawful basis. Check what the script reads before deciding.
Where is my progress stored?
Only in your browser's localStorage under the key tc_checklist, written when you tick an item. Nothing is sent to TapCub. Clearing the ticks removes the key; export a file if you want a lasting record.
How often should I repeat the check?
Whenever you add a tag, a vendor or a market, and at least once a year — the CCPA requires the privacy policy to be reviewed every 12 months anyway.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Data this tool relies on
- GDPR, CCPA/CPRA and PIPL requirements — checked 2026-11-10, reviewed every 6 months (next review by 2027-05-10)
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Fewer items to worry about from your analytics
TapCub counts visits without cookies, honours GPC and Do Not Track, and keeps consent, export and deletion in one compliance centre.