This isn't legal advice, GDPR compliance depends on your specific business and should be checked with someone qualified for your situation. What follows is the plain-English version of the concepts that actually come up when you're running analytics on your own site, so a conversation with a lawyer (or your own reading of the regulation) starts from an informed place instead of zero.
Controller vs. processor: who's responsible for what
GDPR splits responsibility between two roles. The data controller decides why and how personal data is collected, that's you, the site owner. The data processor handles the data on the controller's behalf, following their instructions, that's your analytics provider. This matters because the controller carries the primary compliance obligations toward visitors (transparency, honoring rights requests, having a legal basis for processing), while the processor's obligations are mostly about handling the data securely and only for the purposes the controller set.
In practice: if you install an analytics tool on your website, you are the controller for your visitors' data, not the tool provider. This is true regardless of which analytics tool you use.
What "personal data" covers here
GDPR's definition is broad, anything that could identify a person, directly or indirectly. A name and email obviously qualify. An IP address is generally treated as personal data too, even though it doesn't identify someone by name, which is why privacy-conscious analytics tools avoid storing raw IP addresses at all, deriving a coarse location from it (country, region, city) and discarding the IP itself, rather than keeping something that could theoretically be traced back to a person.
Legal basis: why cookies and consent are actually connected
Consent isn't required for "analytics" as a category, it's required for specific things ePrivacy rules and GDPR treat as needing it, most commonly storing something non-essential on a visitor's device (a cookie, a local storage entry) or building an identifying fingerprint. A tool that doesn't do either of those things can often rely on a different legal basis, like legitimate interest, for the actual data processing, without needing a consent banner for the analytics itself. We go deeper on this specific point in do you need a cookie banner for analytics?
What a Data Processing Agreement (DPA) is, and why it matters
When you (the controller) use a third-party processor, GDPR requires a contract governing that relationship, a Data Processing Agreement. It spells out what the processor can and can't do with the data, how long they keep it, and what happens if there's a breach. If your analytics provider doesn't offer one, that's worth asking about before relying on them for a site with EU visitors.
Data retention: why "forever" is a problem
GDPR's data minimization principle means data shouldn't be kept longer than necessary for the purpose it was collected for. "We might want it someday" isn't a purpose. A defined retention period, after which old data is automatically deleted, is one of the more concrete, checkable things you can point to if a visitor or a regulator ever asks how long their data sticks around.
Visitor rights, and what they mean for analytics data
GDPR gives individuals rights over their data: access, correction, deletion, restriction, and portability. For analytics specifically, this mostly comes up as a deletion request, someone asking to have their visit history removed. If your analytics tool has no way to identify an individual visitor in the first place (no login, no email tied to a visitor ID), there's usually nothing identifiable to delete on request, which is a meaningfully simpler position to be in than a tool that ties visits to named accounts.
The short version
Four questions worth being able to answer about whatever analytics setup you run: Is there a DPA in place with the provider? Does the tool store anything requiring consent (cookies, fingerprinting)? Is there a defined, reasonable data retention period? And can you actually act on a visitor's deletion request if one comes in? If you can answer all four, you're in a defensible position, regardless of which specific tool you're using.