Privacy
RGPD & CNIL
Who is responsible for what, how the cookieless default fits the CNIL audience-measurement exemption, and a paragraph for your privacy policy.
Globatics is built to fit the audience-measurement exemption of the CNIL, the French data protection authority. This page explains who is responsible for what, how the default mode lines up with the CNIL’s conditions, which features take you out of it, and gives you a paragraph for your own privacy policy.
Who is responsible
- You are the controller of your visitors’ data: you decide to measure your site and how.
- Globatics is your processor: it only processes the data on your instructions, under the data processing agreement you accept with the terms. Its providers are listed on Sub-processors; the data stays in the EU (Ireland).
- You must inform your visitors (see the paragraph below) and, outside the exemption, collect their consent.
The CNIL exemption
French law (article 82 of the Data Protection Act, which transposes the ePrivacy directive) requires consent before reading or writing on a visitor’s device, except for trackers that are strictly necessary. The CNIL treats audience measurement as such when it is:
- used only to measure the audience of your own site or app, for you alone;
- limited to producing anonymous statistics;
- not used to follow a person across sites or apps, and not cross-referenced with other processing;
- not sharing non-anonymous data with third parties;
- explained to visitors, who can object;
- kept short: trackers limited to 13 months, collected data kept 25 months at most.
A self-assessment, not a label
There is no CNIL certificate to obtain: you check the conditions yourself and stay accountable for them. Cookieless does not automatically mean exempt, and other EU countries read the rules differently. If in doubt, ask your DPO or lawyer.
How the default mode meets them
| Condition | Globatics, default mode |
|---|---|
| Audience measurement only | Statistics for the site owner; no advertising, no profiling, no reuse by Globatics for its own purposes |
| Anonymous statistics | No cookie, nothing stored on the device; IP used in memory only, never stored; city-level location |
| No cross-site tracking | Visitor id = hash of a daily salt, site id, IP and browser: changes every day, differs on every site |
| No cross-referencing | Data never combined with other sources; public share links show no names or ids |
| No transfer to third parties | Sub-processors only, under a DPA; data hosted in the EU. Icon services that show a referring site’s logo only receive its domain name |
| Retention | 760 days (about 25 months) by default, configurable per site, purged automatically |
| Right to object | Opt-out link #globatics-ignore or the optout command (below) |
What takes you out of the exemption
These features are useful, but they identify or recognise people over time. Turn them on only after the visitor consents:
identify()with your own user ids, and visitor profiles tied to them (Identify and persistence);data-persist, which stores a random id in the browser’s localStorage to recognise visitors across days;- personal data in event properties or traits (e-mail, name, order ids linked to a person);
- using the data for anything other than measuring your audience, or combining it with your CRM or ad tools;
- keeping raw data longer than 25 months (a data retention above 760 days in the site settings).
The simplest pattern: keep the default tag for everyone, and only add data-persist or call identify once your consent tool says yes.
// default tag on every page: <script defer data-site="SITE_ID" src="https://globatics.live/script.js"></script>
onConsentGranted(() => {
globatics("identify", user.id); // only with consent
});Let visitors object
Give visitors a way to object, for example in your privacy policy. Opening https://your-site/#globatics-ignore stops counting that browser on your site (it sets a flag in localStorage at the visitor’s request); #globatics-unignore undoes it. You can also wire a button:
<button onclick="globatics('optout')">Don’t count my visits</button>Add data-respect-dnt to the script tag to stop tracking browsers that send Do Not Track. Browsers sending Global Privacy Control are never followed across days.
Paragraph for your privacy policy
Copy one of these into your privacy policy. In the dashboard, Settings → Tracking gives you the same text filled with your domain and retention, and a variant for sites that use identify or data-persist.
Mesure d’audience. Pour mesurer la fréquentation de example.com, nous utilisons Globatics, un outil de mesure d’audience édité par Penra (France), qui agit pour notre compte en tant que sous-traitant. Globatics ne dépose aucun cookie et n’enregistre pas votre adresse IP : elle sert uniquement, au moment de la visite, à déterminer la ville d’origine et à calculer un identifiant pseudonyme qui change chaque jour et ne permet pas de vous reconnaître d’un jour à l’autre. Les données recueillies (pages consultées, site de provenance, pays et ville, type d’appareil, navigateur et système) servent exclusivement à produire des statistiques anonymes de fréquentation pour notre propre usage ; elles ne sont ni croisées avec d’autres traitements ni transmises à des tiers, et sont conservées 25 mois au plus, dans l’Union européenne. Vous pouvez vous opposer à cette mesure en ouvrant ce lien : https://example.com/#globatics-ignore (vos visites ne seront plus comptées depuis ce navigateur).
Audience measurement. To measure traffic on example.com, we use Globatics, an audience measurement tool published by Penra (France), which acts on our behalf as a processor. Globatics sets no cookies and does not store your IP address: it is only used, at the time of the visit, to determine your city and compute a pseudonymous identifier that changes every day and cannot recognise you from one day to the next. The data collected (pages viewed, referring site, country and city, device type, browser and operating system) is used solely to produce anonymous traffic statistics for our own use; it is not combined with other processing or shared with third parties, and is kept for at most 25 months, in the European Union. You can object to this measurement by opening this link: https://example.com/#globatics-ignore (your visits will no longer be counted from this browser).
Checklist
- Your privacy policy mentions Globatics, with the paragraph above.
- Retention is 25 months or less (Settings → Data retention).
- No personal data in event properties; identify and data-persist only after consent.
- An opt-out link or button is available to visitors.
- Your record of processing lists audience measurement, with Globatics as processor (DPA).