Agency proposals still lead with “we’ll install GA4.” Clients in the EEA, UK, and Australia increasingly push back: consent banners, Google as a US processor, and a privacy policy rewrite they did not budget for. The honest alternative is not “we’ll make you GDPR compliant.” It is a tracker that does not set a first-party analytics cookie, plus a privacy notice that describes what actually happens.
SiteLine is cookieless web analytics plus Google Search Console history, operated by Aglet Technologies. You configure it per client hostname. Events still leave the client’s site and land on SiteLine servers. IP addresses are truncated (IPv4 /24, IPv6 /48) then hashed with the user agent and a daily salt; the raw IP is not stored on the event. That is the model. It is not a legal opinion, and it is not a managed EU-only hosting product.
Point clients at /privacy for Aglet’s policy and /docs/privacy for the tracking mechanics. You still write their notice.
What you can put in a proposal
Be specific. Vague “privacy-first” copy gets bounced by in-house counsel.
You can say:
- The SiteLine tracker does not set a first-party analytics cookie on the client site.
- Collect requests use
credentials: 'omit', so cookies from siteline.tools are not attached to the beacon. - Unique visitors are a same-day hash, not a persistent client id across months.
- Hostnames are allowlisted; events from other hosts are dropped. Known bots are filtered before they hit quota.
- Search Console stays read-only (
webmasters.readonly). SiteLine cannot change sitemaps or search settings. - Plans start at $4.99 USD/month (Growth $19.99, Scale $99.99) with a 7-day trial. Unlimited analytics-enabled domains share one event pool — useful when you run many small client sites.
You cannot say:
- “GDPR compliant analytics” or “no personal data.” Truncated IP plus user agent is still personal information in plenty of readings of the GDPR and the Australian Privacy Act 1988.
- “Data never leaves the EU.” Subprocessors include Stripe and Cloudflare. Compute is not marketed as a single EU region. See EU analytics after Schrems.
- “You will never need a cookie banner.” True only for this analytics cookie. Tag Manager, ads pixels, HubSpot, Hotjar, and Shopify’s own cookies are the client’s problem. See Do I need a cookie banner for analytics?.
If the client’s stack is already a Christmas tree of pixels, swapping GA4 for SiteLine does not make the tree disappear. It removes one cookie-setting analytics vendor.
How to install without becoming the client’s processor by accident
Practically, agencies do one of two things:
- Client-owned SiteLine account. The client signs up, connects Search Console, adds the snippet. You get invited later if collaboration is enabled; today a subscription is one user. This is the cleaner controller/processor story: the client has the contract with Aglet Technologies.
- Agency-owned account holding client properties. Common for retainers. Then you are putting client site traffic into your SiteLine workspace. Your client contract should say that. Do not hide it in a “we use industry-standard tools” footnote.
Either way, name SiteLine and Aglet Technologies in the client’s privacy policy. Copy-paste from /privacy; do not invent “fully anonymised EU hosting.”
The snippet is a first-party or proxied script posting to /api/analytics/event. If ad blockers eat third-party collect, the client can configure their own reverse proxy (nginx, Caddy, Cloudflare, or Vercel). SiteLine does not sell a managed CNAME in v1. Proxying does not keep events on the client’s servers — it only changes the browser-visible host. Details: First-party analytics proxy.
Reporting that survives a privacy review
Clients ask three questions in every QBR:
Where are unique visitors from? A daily hash. Same person tomorrow is a new id. Do not present “returning users over 30 days” as a cookie-style cohort. You can show pageviews, paths, referrers, UTMs, countries, device class, goals, and funnels.
How long do you keep it? Analytics while subscribed, then 30 days’ grace, then purge. Search Console imports while the account exists. If a client leaves, delete the analytics site or the whole account; do not keep a ghost property “for case studies” unless they agreed in writing.
Who else sees it? SiteLine does not sell data or use it for ads. AI clients (MCP) only see data if the account holder connects them. Stripe sees billing. Cloudflare may see email and edge traffic. App cookies on siteline.tools are session, CSRF, and theme/sidebar — irrelevant to the client’s visitors.
For Australian clients, map this onto the Australian Privacy Principles rather than pasting EU language. Start with Analytics and the Australian Privacy Act.
The banner conversation
Agencies get hired to “remove the cookie banner.” Sometimes that is possible for analytics cookies. Often it is not, because the CMS, the booking widget, and the ad account still set cookies. SiteLine removes the analytics-cookie reason. It does not repeal the ePrivacy Directive or UK PECR.
Walk the client through every script in the <head>. If SiteLine is the only remaining non-essential cookie, they may be able to drop the banner for analytics. If not, keep the banner and stop blaming the analytics tool. GDPR analytics without a consent banner is the EU-shaped version of that talk.
Questions: [email protected].
FAQ
Can we white-label SiteLine as the agency’s own analytics?
The product is SiteLine by Aglet Technologies. Events go to SiteLine servers. You can proxy the script from the client domain; you cannot pretend the processor is “our EU cloud” if it is not. Name the vendor in the client privacy notice.
Do we need a cookie banner if every client site only has SiteLine?
For this tracker’s analytics cookie, no — there isn’t one. You still need a privacy notice, a legal basis for the processing, and a banner if other cookies or similar technologies remain. This is not legal advice.
What happens to client data if they churn?
Analytics is kept while access is active plus a 30-day grace, then purged. Search Console history stays while the account exists. Delete the account (or have the client delete theirs) when the retainer ends if they want the data gone. Policy: /privacy.