Self-Hosted Analytics Without DPAs: GDPR, HIPAA, CCPA Guide

Privacy regulations are everywhere now. GDPR in Europe, CCPA in California, HIPAA for healthcare, and the list keeps growing. If you run a website or app, you've probably wondered: "Am I actually compliant with all this?"

The good news: analytics compliance doesn't have to be complicated or expensive. The bad news: most traditional analytics tools make it harder than it needs to be.

This guide breaks down the major compliance frameworks, explains what they mean for your analytics setup, and shows how OpenPanel helps you stay compliant without the headache.

Why analytics compliance matters

When someone visits your website, you collect data about them. Maybe their location, what pages they viewed, how long they stayed, or what buttons they clicked. Under most privacy laws, this counts as personal data.

The consequences of getting compliance wrong are real. GDPR fines can reach €20 million or 4% of global revenue, whichever is higher. CCPA violations cost up to $7,988 per intentional violation. Beyond the fines, there's reputation damage and lost customer trust.

Most analytics compliance issues come down to a few core problems.

Third-party data sharing. When you use Google Analytics or similar tools, your visitors' data flows through their servers. That creates a chain-of-custody problem. You're responsible for what happens to that data, even when it sits on someone else's infrastructure.

Cookies and consent. Traditional analytics tools rely heavily on cookies. Under GDPR, PECR, and similar regulations, you need explicit consent before dropping most cookies. That means cookie banners, consent management, and all the friction that comes with it.

International data transfers. If you collect data from EU residents and it ends up on US servers, you have a potential compliance issue. This is why Google Analytics has been ruled illegal in several EU countries.

The fix: either use a privacy-first analytics tool that sidesteps these issues, or self-host your analytics so data never leaves your infrastructure.

The General Data Protection Regulation is the big one. It applies to any organization that processes personal data of EU residents, wherever that organization is based. So if you have visitors from Europe, GDPR applies to you.

GDPR is built around a few principles that directly affect how you can do analytics.

Lawful basis for processing. You need a legal reason to collect and process personal data. For analytics, that usually means getting consent or demonstrating "legitimate interest." Consent is cleaner but requires those cookie banners. Legitimate interest is possible but requires documentation and balancing tests.

Data minimization. Only collect what you need. If you track 50 user properties but only look at 5, you have a problem.

Right to erasure. Users can ask you to delete their data. You need to be able to actually do this, which is tricky when your data sits in a third party's database.

Transparency. Users need to know what you collect and why. This means clear privacy policies and, in most cases, cookie consent interfaces.

Why Google Analytics keeps getting banned

Data protection authorities in Austria, France, Italy, and other EU countries have declared Google Analytics non-compliant with GDPR. The core issue: GA transfers personal data (including IP addresses) to US servers, where US intelligence agencies can potentially access it. This violates Chapter V of GDPR, which governs international data transfers.

Even with IP anonymization enabled, the data still hits Google's servers before being anonymized. That's a problem.

This is how OpenPanel dashboard looks like, the self-hosting version has all features that our cloud version has. The release lifecycle is 2-3 months behind cloud version.

OpenPanel takes a different approach. We built it with privacy as the foundation, not an afterthought.

Cookieless by default. OpenPanel doesn't use cookies for tracking. No cookies means no cookie consent banners for basic analytics. Your visitors get a cleaner experience, and you avoid consent management. Learn more about how this works in our cookieless analytics guide.

No third-party data sharing. With OpenPanel Cloud, your data stays in our EU-based infrastructure. With self-hosting, data never leaves your servers at all.

Built-in data export and deletion. Need to handle a data subject request? OpenPanel's Export API makes it straightforward to export user data. You can delete your entire project's data through the dashboard, and if you need to delete a specific identified profile, you can request that from us.

Transparent and open source. You can audit the code yourself to see exactly what's collected and how it's processed.

CCPA: California's privacy law

The California Consumer Privacy Act (and its amendment, CPRA) gives California residents specific rights over their personal information. If you do business in California or collect data from California residents, this one matters.

Key CCPA requirements

Right to know. Consumers can ask what personal information you've collected about them, where it came from, and who you've shared it with.

Right to delete. Like GDPR, consumers can request deletion of their personal information.

Right to opt-out. Here's the big one for analytics. Consumers can opt out of the "sale" or "sharing" of their personal information. Under CCPA, "sharing" includes providing data to third parties for cross-context behavioral advertising, which is exactly what many analytics tools do.

No discrimination. You can't treat consumers differently because they exercised their privacy rights.

The "Do Not Sell" problem

Many traditional analytics tools technically "share" your user data with third parties. When you use Google Analytics, user data flows through Google's systems and can be used for their own purposes. Under CCPA, this could count as sharing, which means you need to honor "Do Not Sell or Share" requests.

That's a real operational burden. You need systems to track opt-out requests, communicate them to all your vendors, and verify compliance.

How OpenPanel simplifies CCPA

With OpenPanel, there's no sharing to opt out of.

When you use OpenPanel Cloud, your data is processed solely for your analytics. We don't sell or share it with anyone. When you self-host OpenPanel, you control the entire data pipeline, with no third party involved at all.

This eliminates most CCPA complexity. You still need proper privacy disclosures, but you don't need to manage vendors for your analytics data.

HIPAA: healthcare's special rules

If you're in healthcare or handle Protected Health Information (PHI), HIPAA adds another layer of requirements. This is where things get expensive with traditional analytics providers.

The BAA requirement

HIPAA requires any third party with access to PHI to sign a Business Associate Agreement (BAA), a legal contract that sets out what the vendor can and can't do with health information.

The problem: most analytics providers either don't offer BAAs at all or charge a steep premium for them. We're talking enterprise-tier pricing that can run into tens of thousands of dollars a year.

Google Analytics doesn't offer a BAA. Mixpanel does, but only on enterprise plans. The same goes for most major analytics platforms.

What counts as PHI in analytics

This is where many healthcare organizations get tripped up. PHI isn't just medical records. Under HHS guidance, when someone visits a healthcare website's authenticated pages, their IP address combined with the fact that they're viewing health-related content can constitute PHI.

So if you use cookie-based tracking on a patient portal or healthcare app, you might be sharing PHI with your analytics provider without realizing it.

The self-hosting solution

Self-hosting changes the equation: if you host your own analytics, you don't need a BAA.

A BAA is required when you share PHI with a business associate. But if you self-host OpenPanel on your own HIPAA-compliant infrastructure, there's no third party involved. The data never leaves your environment, and there's no business associate relationship to manage.

This gets you meaningful analytics from your healthcare applications without the enterprise pricing or legal complexity. Deploy OpenPanel on your existing HIPAA-compliant servers using Docker Compose, Kubernetes, or your preferred method, and you're done.

If you have visitors from the UK, you need to think about PECR (Privacy and Electronic Communications Regulations) alongside UK GDPR. PECR specifically regulates cookies and similar tracking technologies.

What PECR requires

PECR has a simple but strict rule: you need consent before storing or accessing information on a user's device. This includes cookies, local storage, and similar technologies.

There are only two exemptions. The "communication exemption" covers technologies essential for transmitting a communication. The "strictly necessary exemption" covers technologies essential for providing a service the user explicitly requested.

Here's the important part: analytics cookies are not exempt. The UK's Information Commissioner's Office has been clear about this. If you use cookie-based analytics, you need consent.

Fines are increasing

PECR fines used to be capped at £500,000. The new Data (Use and Access) Act aligns PECR penalties with UK GDPR, meaning fines of up to £17.5 million. The ICO has also been more active in enforcing cookie compliance.

Cookieless analytics bypasses PECR

Since OpenPanel's tracking is cookieless, the PECR consent requirement doesn't apply to basic analytics. You're not storing anything on the user's device, so there's nothing to consent to.

This doesn't mean you can track whatever you want. UK GDPR still applies to processing personal data. But you can skip the cookie banners and consent management platforms that PECR would otherwise require.

The self-hosting advantage

We've mentioned self-hosting several times, for good reason. It's the single most effective way to simplify analytics compliance across almost every framework.

What self-hosting actually means

When you self-host OpenPanel, you run the entire analytics platform on your own infrastructure. That could be your own servers, your cloud account (AWS, GCP, Azure, etc.), or a simple VPS.

The data flow is completely different from traditional analytics.

Traditional analytics: User → Your website → Analytics provider's servers → Provider dashboard

Self-hosted analytics: User → Your website → Your servers → Your dashboard

That middle step makes all the difference. With traditional analytics, you share data with a third party. With self-hosting, data never leaves your control.

Compliance benefits across frameworks

GDPR: No international data transfers if you host in the EU. Full control over data retention and deletion. No third-party data sharing to manage.

CCPA: No "selling" or "sharing" by definition. You're not providing data to any third party.

HIPAA: No BAA required because there's no business associate. PHI stays within your HIPAA-compliant environment.

PECR: Cookieless tracking means no consent requirements for basic analytics.

SOC 2: Easier vendor risk management when you control the analytics infrastructure. Your existing security controls apply.

Beyond compliance

Self-hosting isn't only about compliance. There are practical benefits too.

Cost predictability. No per-event pricing surprises. Your costs are your server costs, which are usually much lower than SaaS analytics pricing at scale.

No vendor lock-in. Your data is in your database. You can query it however you want, integrate it with other systems, or migrate away anytime.

Performance. Data stays close to your users. No external requests that ad blockers might block.

Full transparency. OpenPanel is open source. You can audit exactly what's collected and how.

Getting started with self-hosting

We've tried to make self-hosting as simple as possible. The basic process is:

git clone https://github.com/openpanel-dev/openpanel.git
cd openpanel/self-hosting
./setup
./start

We have detailed guides for different deployment options, including Docker Compose, Coolify, Dokploy, and Kubernetes.

Check out our full self-hosting guide for a walkthrough of the whole process.

The hidden cost of "free" analytics

Take Google Analytics. It's free, which is great. But that "free" comes with compliance costs most organizations don't account for.

Cookie consent management. You need a consent management platform, ongoing maintenance, and likely worse data quality from users who opt out.

Privacy policy and legal review. Your lawyers need to review how GA processes data and update your privacy documentation.

Vendor assessment overhead. For regulated industries, you need to continuously assess Google's practices and compliance posture.

GDPR risk. Given the ongoing regulatory actions against GA in Europe, you're taking on legal risk that's hard to quantify.

Data subject requests. Handling deletion requests through GA's tools is cumbersome and incomplete.

Add these up, and "free" analytics often isn't free at all. A transparent, paid tool like OpenPanel or a self-hosted setup often works out cheaper while being more compliant.

Other regulations worth knowing

GDPR, CCPA, HIPAA, and PECR are the big ones, but there are others depending on your audience.

LGPD (Brazil): Similar to GDPR, with requirements for consent, data minimization, and user rights.

PIPEDA (Canada): Requires consent for collecting and using personal information, with some exceptions.

US State Laws: Over 20 US states now have comprehensive privacy laws, including Virginia, Colorado, Connecticut, and more. Most follow patterns similar to CCPA.

The good news: if you're compliant with GDPR and CCPA, you're probably in good shape for most of these. And if you use cookieless, self-hosted analytics, you're ahead on all of them.

Getting started

Ready to simplify your analytics compliance? You have two paths with OpenPanel.

OpenPanel Cloud is the fastest way to start. We handle the infrastructure, and your data is processed in compliance with GDPR and CCPA. You can be up and running in minutes with a simple script tag.

Self-hosted OpenPanel gives you maximum control and compliance flexibility. It's a good fit for healthcare organizations, enterprises with strict data residency requirements, or anyone who wants complete ownership of their analytics data.

Either way, you get cookieless tracking, real-time dashboards, funnels, user profiles, and the features you need to understand your users without the compliance complexity.

Get started with OpenPanel Cloud or check out our self-hosting documentation.