Is Live Visitor Tracking GDPR-Safe?
Updated
TL;DR
Whether any tool is "GDPR-safe" depends on how you use it, so we make no GDPR compliance claim for whoisbrowsing; what we can tell you is exactly what it collects and what it never shows. Visitors from the EU/EEA, UK and Switzerland, and browsers with Global Privacy Control, are never shown, nothing about your visitors is stored on our servers, and no cookies are set on your visitors. This is not legal advice.
What this page is, and is not
This is a plain description of what whoisbrowsing does. It is not legal advice, not a certification and not a statement about what the law requires of you. If you need to know whether your site needs a privacy notice, a consent banner or a data processing agreement, ask a qualified privacy adviser. The primary text is the General Data Protection Regulation on EUR-Lex.
What your visitors' browsers send
Your visitors' browsers send the page, pointer position, clicks, scroll, device type, source, browser and operating system, and time on site. Never keystrokes, form values or page text.
| Sent | Not sent |
|---|---|
The page (query strings never leave the browser; URL tokens in a path, meaning UUIDs, long hex strings and long random tokens, are sent as :id) |
Anything typed, including passwords and card details |
| Pointer position, clicks, scroll | Form values |
| Device type, browser, operating system | Page text |
| Source (Google, Bing, ChatGPT, Perplexity, Gemini, Copilot, Claude, another site's link, or direct) | A name, email or account |
| Time on site | A cookie or other identifier stored on the visitor's device |
The owner sees an approximate city, for example "near Austin, TX", never an identity. See how the city is worked out. We never store or show IP addresses.
What is never stored
Nothing about your visitors is stored on our servers. The view is live only. That means no recordings, no history and no heatmaps over time. When a visitor leaves, they are gone from the view and there is nothing to export, query or delete later.
Who is never shown
Visitors from the EU/EEA, UK and Switzerland, and browsers with Global Privacy Control, are never shown. So the people the GDPR is most often discussed for do not appear in the live view at all. In practice, a visitor whose connection comes from one of those countries is served an empty script, and a live connection from there is refused, so nothing from that visit reaches the live view.
Two things are worth being careful about:
- This is a choice we made about the product, not a legal conclusion about those regions. We exclude them so the owner never has to decide.
- Excluding them means you will see fewer visitors than actually visit. If most of your audience is in those regions, the live view will look quiet. That is the cost.
Global Privacy Control is a browser signal a visitor can turn on. We treat it as a request not to be shown. See Global Privacy Control explained.
Three visitors, three outcomes
A short example makes the rules concrete. Say your site is in the US and three people open your pricing page at the same moment:
| Visitor | What the owner sees |
|---|---|
| Someone in Lyon, France | Nothing. Visitors from the EU/EEA are never shown |
| Someone in Ohio whose browser sends Global Privacy Control | Nothing. GPC browsers are never shown |
| Someone in Ohio with no GPC signal | A cursor on the page and one line, such as "near Columbus, OH", with the source and device |
Even for the third visitor, the owner never sees a name, an email, an IP address or anything they typed.
No cookies is not the same as no rules
Setting no cookies on visitors removes one specific thing: our script does not store anything on their device. It does not by itself settle every question under privacy law, which also covers processing, notices and your own site's other tools. Read real-time analytics without cookies for the honest version.
What you still own as the site owner
Even with a tool that stores nothing, you remain responsible for your own site: your privacy notice, your other scripts and the other services you use. A plain sentence in your privacy notice describing the live view is a reasonable step to discuss with your adviser. We do not provide template legal text.
When whoisbrowsing is NOT the right tool
If you need to see EU visitors, you need a different product, and you should weigh its consent and storage requirements. whoisbrowsing will not show them. Also, if you need history, a replay product or analytics tool is the right place, with its own privacy obligations.
Read the primary statement
Our own words are on the privacy page, and the mechanism is explained in How it works. It is free, with no credit card.
Frequently asked questions
- Does whoisbrowsing guarantee GDPR compliance?
- No, we make no compliance claim. Compliance depends on how you use a tool, your legal basis and your notices, and it is a question for a qualified adviser. What we can say is what the tool does: no cookies on visitors, nothing stored on our servers, and visitors from the EU/EEA, UK and Switzerland, and browsers with Global Privacy Control, are never shown.
- Does whoisbrowsing show visitors from the EU?
- No. Visitors from the EU/EEA, UK and Switzerland, and browsers with Global Privacy Control, are never shown.
- Does it collect names, emails or form input?
- No. Your visitors' browsers send the page, pointer position, clicks, scroll, device type, source, browser and operating system, and time on site. Never keystrokes, form values or page text.
- Is anything stored about my visitors?
- Nothing about your visitors is stored on our servers. The view is live only: there are no recordings, history or heatmaps over time.