analytics
Selection
Choose based on what you want to measure and the burden of obtaining consent.
- Cloudflare Web Analytics — Does not use cookies or store identifiers on the client side. It is sufficient if you only need page views, referrers, and Core Web Vitals. It does not introduce the burden of a cookie banner.
- Google Analytics — Use it when you need user-level funnels, conversions, or advertising integrations. Because it uses cookies, consent management is required.
- Workers Analytics Engine — Use it when you need to record custom events over time. It lets you keep application-side metrics on the server side.
- GraphQL Analytics API — Use it to retrieve statistics about requests and caching handled by Cloudflare. It does not require adding client-side JavaScript.
These solutions can be used together. Keeping baseline figures for every page with Web Analytics while using GA only for the paths that need it can minimize the scope of consent management.
Google Analytics and Consent
Confirm how cookies will be used and send a consent signal when consent is obtained.
- Always set analytics_storage to granted. Keep basic analytics enabled at all times.
- Set ad_storage, ad_user_data, and ad_personalization to granted by default.
- If the user selects “Do Not Consent,” update the three advertising-related values to denied.
When targeting regions where prior consent is required, such as the EEA and the UK, do not use granted as the default for advertising-related signals. Set them to denied and update them to granted after consent is obtained. Verify the target regions before choosing the default values.
html
<script>
window.dataLayer = window.dataLayer || [];
function gtag() { dataLayer.push(arguments); }
gtag('consent', 'default', {
analytics_storage: 'granted',
ad_storage: 'granted',
ad_user_data: 'granted',
ad_personalization: 'granted',
});
</script>
js
// 「同意しない」を選んだとき
gtag('consent', 'update', {
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
});
- Run default before loading the tags. If the order is reversed, the default values will not take effect.
- Save the user's selection and restore the same state when they return. Do not display the banner on every visit.
- Provide a way to withdraw consent. Do not make it impossible to change the decision after consent has been granted.
- Do not let the banner cover the primary content. Make it keyboard accessible and ensure that focus is contained appropriately.
- Do not hard-code measurement IDs, conversion settings, or event names and branch between environments in the code. Switch between them using environment variables.
Cloudflare Web Analytics
Because it does not use cookies or client-side identifiers, it is generally not subject to cookie-banner requirements. However, assess it in the context of the laws in the target regions and any other analytics tools or tags in use. Do not assume that consent is unnecessary simply because Web Analytics has been added.
There are two ways to integrate it.
- Automatic — Enable it from the dashboard for domains proxied through Cloudflare. No HTML changes are required.
- Manual — Add the beacon script to the HTML. This can also be used when the content is not delivered through Cloudflare.
It provides page views, referrers, country, device, Core Web Vitals, and similar data. It does not support user-level tracking or funnel analysis. Combine it with GA if those capabilities are needed.
Workers Analytics Engine
Write application-specific events from Workers.
ts
// wrangler の設定で ANALYTICS バインディングを定義しておく
env.ANALYTICS.writeDataPoint({
blobs: ['checkout', 'card'],
doubles: [amount],
indexes: [tenantId],
})
- Use low-cardinality values for indexes. Do not use values such as user IDs.
- Do not put personally identifiable information in blobs or doubles. Do not write email addresses, names, or raw IP addresses.
- Perform writes asynchronously and keep them within limits that do not delay the request response.
- Perform aggregation through the SQL API or GraphQL.
Common Precautions
- Do not delay page rendering for analytics. Load tags asynchronously.
- Do not include values that can identify individuals in URLs or event parameters. Do not send email addresses, membership numbers, or tokens.
- Exclude internal traffic and staging environments from analytics. They distort the data.
- Decide what you want to measure first. Do not configure the solution to collect everything available.
- Adding tracking tags and being able to use the data for decision-making are separate concerns. Decide which metrics to monitor and who will use them before adding the tags.
Final Checklist
- If cookie-based tracking is being used, are consent acquisition and withdrawal paths available?
- Does the gtag consent default run before the tags are loaded?
- Were the advertising-related default values set according to the target regions?
- Is the consent selection saved and restored on subsequent visits?
- Is the cookie banner keyboard accessible, and does it avoid covering the primary content?
- Are values that can identify individuals excluded from events and URLs?
- Are staging and internal traffic excluded?
- Can measurement IDs be switched through environment variables instead of being hard-coded?