analytics

analytics

Selection

Choose based on what you want to measure and the burden of obtaining consent.

• Cloudflare Web Analytics — Does not use cookies and does not store identifiers on the client side. If you only want to see page views, referrers, and Core Web Vitals, this is enough. There is no burden of a cookie banner.
• Google Analytics — If you need user-level funnels, conversions, and ad integrations. Because it uses cookies, consent management becomes necessary.
• Workers Analytics Engine — When you want to record custom events as time series. You can hold application-side metrics on the server side.
• GraphQL Analytics API — Retrieve statistics on requests and cache held by Cloudflare. This avoids adding client-side JavaScript.

They may be used together. Having raw numbers for all pages with Web Analytics and adding GA only to the necessary flows reduces the scope of consent management.

• GA4 https://developers.google.com/analytics/devguides/collection/ga4
• Consent Mode https://developers.google.com/tag-platform/security/guides/consent
• Cloudflare Web Analytics https://developers.cloudflare.com/web-analytics/
• Workers Analytics Engine https://developers.cloudflare.com/analytics/analytics-engine/
• GraphQL Analytics API https://developers.cloudflare.com/analytics/graphql-api/

Google Analytics and consent

Confirm the use of cookies and send a consent signal when consent is obtained.

• Set analytics_storage to always granted. Basic analytics are always enabled.
• Set ad_storage, ad_user_data, and ad_personalization to granted by default.
• If the user selects "do not consent," update the three ad-related items to denied.

If targeting regions that require prior consent (EEA, UK, etc.), set the ad-related defaults to denied rather than granted, and update them to granted after obtaining consent. Decide the default values after confirming the target regions.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  gtag('consent', 'default', {
    analytics_storage: 'granted',
    ad_storage: 'granted',
    ad_user_data: 'granted',
    ad_personalization: 'granted',
  });
</script>

// 「同意しない」を選んだとき
gtag('consent', 'update', {
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
});

• Execute default before the tag loads. If the order is reversed, the default values will not take effect.
• Save the selection result and restore the same state on revisit. Do not show the banner every time.
• Provide a way to withdraw consent. Do not make it so that once consent is given it cannot be changed.
• Do not cover the main content with the banner. Make it operable with a keyboard and in a form where focus is trapped.
• Do not hard-code measurement IDs, conversion settings, and event names in the code and branch them by environment. Switch them with environment variables.

Cloudflare Web Analytics

Because it uses neither cookies nor client-side identifiers, in many cases it is not subject to a cookie banner. However, judge based on the legal system of the target region and the other analytics and tags you have installed. Do not jump to the conclusion that consent is unnecessary just because you installed Web Analytics.

There are two installation methods.

• Automatic — Enable it from the dashboard for domains routed through Cloudflare as a proxy. Do not change the HTML.
• Manual — Put the beacon script into the HTML. It can also be used for delivery that does not go through Cloudflare.

What you can see is page views, referrers, countries, devices, Core Web Vitals, and so on. Per-user tracking and funnel analysis are not possible. If you need those, use GA alongside it.

Workers Analytics Engine

Write app-specific events from Workers.

// wrangler の設定で ANALYTICS バインディングを定義しておく
env.ANALYTICS.writeDataPoint({
  blobs: ['checkout', 'card'],
  doubles: [amount],
  indexes: [tenantId],
})

• Make indexes have low-cardinality values. Do not put values like user IDs in them.
• Do not put personal information in blobs or doubles. Do not write email addresses, names, or raw IPs.
• Writes are asynchronous, and keep them within a range that does not delay the request response.
• Perform aggregation from the SQL API or GraphQL.

Common cautions

• Do not delay page display for the sake of measurement. Load tags asynchronously.
• Do not put personally identifiable values in URLs or event parameters. Do not send email addresses, membership numbers, or tokens.
• Exclude internal access and staging environments from measurement. The numbers get dirty.
• Decide what to measure first. Do not set things up to collect everything that can be collected.
• Adding measurement tags and being able to use them for decision-making are different things. Decide the metrics to watch and who will watch them before adding them.

Check before finalizing

• If you are using cookie-based measurement, is there a flow for obtaining and withdrawing consent?
• Is gtag's consent default executed before the tag is loaded?
• Have you decided the advertising-related default values according to the target region?
• Is the consent choice saved and restored on return visits?
• Can the cookie banner be operated with a keyboard, and does it not cover the main content?
• Are personally identifiable values not included in events or URLs?
• Have you excluded staging and internal access?
• Do measurement IDs switch via environment variables? Are they not hard-coded?