Compliance · Updated September 8, 2026

Compliance Overview

Good analytics should help you understand your website while respecting the people who visit it. These guides explain the rules, the choices you need to make, and where to find the details about Fathom.

Start with your visitors

Different rules can apply at the same time. A European website may need to consider both personal-data protection and rules about accessing information on visitors’ devices. A service used by children has additional responsibilities.

  • GDPR: personal data, lawful bases, and processing agreements.
  • ePrivacy: EU rules for cookies and other device information.
  • EU–US data transfers: transfer mechanisms and safeguards.
  • PECR: UK device-access rules and the statistical purposes exception.
  • CCPA / CPRA: California privacy rights and business obligations.
  • COPPA: US rules protecting children under 13.

How Fathom approaches privacy

Fathom’s visitor analytics uses no tracking cookies. It produces website statistics using site-specific visitor signatures, with a salt that rotates daily. The data journey explains collection, hashing, storage, and the separate handling of bot traffic.

Collecting less information reduces risk, but a privacy-focused tool does not make every use of analytics compliant automatically. Request data can include personal data before it is transformed, and hashing is not by itself a legal guarantee of anonymity.

Cookies and consent

Cookie-free does not automatically mean outside device-access rules. Consent requirements depend on the technology, its purpose, the applicable law, and any exception you rely on. See the ePrivacy and PECR guides before deciding how analytics should load on your site.

Your privacy notice should explain your use of analytics. Our privacy policy guidance is a starting point to adapt to your own practices.

Documents for your review

Use our data processing agreement, subprocessor list, and privacy policy alongside these guides. They cover different parts of the relationship: analytics processing, the providers involved, and Fathom’s own handling of personal data.

Avoid sending names, email addresses, account IDs, or sensitive information in page URLs and event names. Review the data your implementation sends, including custom events and integrations.

These guides explain privacy requirements and how they relate to Fathom. They are general information, not legal advice. Your obligations depend on your website, its visitors, and how you use analytics. Contact us for information about your setup.