§1 "Compliant" is not a checkbox
The phrase "GDPR-compliant analytics" gets used to describe everything from "we added a cookie banner" to genuinely re-architected data flows. The difference matters enormously in an audit, and it matters to the people whose data you're collecting. Compliance is a property of the system, not a feature you bolt on at the end.
§2 Consent as infrastructure, not a banner
We treated consent state as a first-class data field that travels with every event, not a gate that simply blocks or allows a script tag. That meant the consent management platform's decision had to be available server-side, queryable at the point any data left the building — not just enforced in the browser, where it's trivially bypassed by a misconfigured tag.
§3 Data minimisation in practice
"Collect less" sounds simple until you're staring at a tag manager with 80 variables firing on every page load. We audited every variable against a single question — what business decision depends on this field? — and removed roughly a third of them. The smaller footprint also made the system faster to reason about and cheaper to store.
- Hashed identifiers wherever raw PII wasn't strictly required for the use case
- Retention windows enforced at the warehouse level, not by policy document alone
- Geo-fencing of data residency for EU user data
§4 Vendor review and data processing agreements
Every third-party tool that touched user data — analytics platforms, CRMs, ad networks, the CMP itself — went through a documented review: where is the data processed, what's the legal basis, is there a signed DPA, and what happens to the data if we offboard the vendor. This is unglamorous work, and it's exactly the work an audit actually checks.
§5 Auditing and keeping the documentation honest
The single biggest risk we found wasn't a technical gap — it was documentation that no longer matched reality. A consent flow that changed six months ago, with no update to the record of processing activities, is a finding waiting to happen.
We set a quarterly cadence to re-walk the data flow diagrams against the live system, and treat any mismatch as a bug, not a paperwork backlog. That habit is what got the eventual audit through with zero findings.