An analytics tool can provide privacy controls, but a plugin cannot establish GDPR compliance for every site. Evaluate what you collect, where it is processed, who can access it, how visitors make choices and how long you keep records.
What should you check?
| Area | Practical question |
|---|---|
| Collection | Are IPs, usernames, emails or precise locations recorded? |
| Consent | Does the selected integration behave correctly before a choice, after acceptance and after withdrawal? |
| Storage | Which database, host, backups and optional services hold data? |
| Access | Who can see visitor-level reports and exports? |
| Retention | Are old records deleted or only moved into archives? |
| Requests | Can your process locate and handle a visitor’s stored data? |
Use the answers in your site’s privacy review. Hosting location, vendor arrangements and applicable obligations need their own assessment.
What SlimStat does
SlimStat records core analytics in your WordPress database, or a configured external database with Pro. Reports appear inside WordPress. It offers IP anonymization, hashing, cookie controls, consent integration, exclusions and retention settings.
In SlimStat 6, GDPR Compliance Mode, IP anonymization and IP hashing are off by default. Tracking cookies are on. Existing installs retain their settings. Configure the controls before collection and test them with your actual banner and caching setup.
Optional services can make external connections: examples include geolocation database downloads, email delivery, maps and Pro license validation. Self-hosting your analytics does not mean every component on the site makes no external request.
Cookieless does not mean no identifiers
A hashed identifier, a username or a distinctive URL can still distinguish a visitor. Cookie controls are one part of the setup. Decide which fields you need, remove unnecessary collection and protect detailed reports.
Archives need a retention decision
SlimStat’s default live retention period is 420 days and Archive Mode is enabled on new installs. Archiving moves old records into separate tables. It does not erase them. Turning Archive Mode off affects future purges; existing archives and backups need separate handling.
Review retention and avoid publishing visitor records through a public shortcode or export.
A practical setup sequence
- Install Free.
- Configure and test consent.
- Review IP, cookie, location and exclusion settings.
- Restrict report access and choose retention deliberately.
- Document the resulting behavior in your site’s privacy process.
Pro adds reporting tools; it is not a compliance upgrade. Choose it when you need heatmaps, funnels, exports or scheduled reporting. Compare Free and Pro.