Is the tracking GDPR-compliant?
Yes — XICTRAQ is built privacy-first: cookieless, no cookies, no storage on the device for reach measurement (no localStorage), no transfer to third parties, IP addresses are not stored in clear text and hosting is exclusively in the EU. Because no cookies are set, the classic reason for a cookie banner falls away — you measure all visitors, not just those who accept a banner.
For reach measurement, no cookies or comparable identifiers are stored on or read from the device; the IP address is used server-side for processing only and is not stored in clear text. No data is transmitted to third parties.
Instead of cookies or persistent profiles, XICTRAQ uses a server-side, pseudonymous daily identifier formed from the IP address and a daily key. The daily key is a random value generated anew each day and deleted once the day is over; the IP address itself is not stored. Re-identification beyond the day does not take place in reach measurement; the exception is customer recognition from the Business plan, which assigns visits of signed-in customers via their customer number. As no banner clicks sessions away, traffic is captured completely.
Session recording is optional and starts only after explicit consent via your consent solution — without consent no recording takes place. Only after consent does the tracker store an identifier for the recording in sessionStorage for the duration of the session.
Still have questions?
Our team from Lower Saxony is happy to help.