Consent and click analytics: what a redirect may record

The redirect happens before consent exists

When someone clicks a short link, your server receives a request and must answer it immediately. There is no page yet, no banner, no opportunity to ask anything. By the time a consent dialog can be displayed, the redirect has already been served and whatever was recorded has already been recorded.

This sequencing is why the consent conversation about redirects is different from the one about site analytics. On a website you can choose to load a tracker only after permission. On a redirect you cannot ask first, so the question becomes what you may record without asking, and how to keep that to the minimum that does the job.

Separate counting from identifying

Counting how many times a link was followed is not the same as building a profile of who followed it. The first is a measurement of your own content. The second involves personal data and attracts a much heavier set of obligations. Most of the value in link analytics comes from the first, and a great deal of the risk comes from casually acquiring the second.

Aggregate counts with no per-click record, or per-click records with no stable identifier, will answer nearly every practical question: which campaign worked, when traffic arrived, which channel produced volume. Insisting on identifying individuals for a marketing link is usually a habit rather than a requirement, and it is worth asking who would act on that data if they had it.

The data that arrives unavoidably

Any HTTP request carries an IP address, a user agent string and often a referrer. You did not choose to collect these; they are how the request reached you. What you choose is what happens next: whether they are written to a log, how long that log is kept, whether the IP is stored in full or truncated, and whether anything derived from them is joined to other records.

IP address is the sensitive one, because in most privacy regimes it is personal data. Truncating it before storage, or converting it to a country and discarding it in the same operation, preserves the analytical value almost entirely while removing the identifier. Do the truncation at the point of ingestion, not in the reporting layer, or the full value still exists somewhere.

Legitimate interest covers less than people assume

Basic, aggregated measurement of your own links is defensible as a necessary operational activity. Cross-site profiling, retargeting pixels fired on the redirect, and enrichment against third-party identity data are not the same category and generally require consent, which as established you cannot obtain at that moment.

The practical line is whether the processing serves the delivery and measurement of the link itself, or whether it serves a separate advertising purpose. A retargeting pixel injected into an interstitial is the clearest example of the second, and it is exactly the feature most likely to be enabled without anyone reviewing it.

Retention is the cheapest control you have

Long retention adds risk continuously and adds insight rarely. Nobody makes a decision from an individual click record eighteen months old, but everyone is exposed to it in a breach or an access request. Keep raw per-click rows for a short window, aggregate them into the counts you actually report, and delete the raw rows on a schedule that runs without anyone remembering to trigger it.

Write the retention period into a policy and then verify that the deletion job exists and runs. The gap between a stated retention policy and the actual contents of a database is where most compliance failures live, and it is discovered at the worst possible time.

Tell people in a place they can find

If you operate a branded short domain, the privacy notice on your main site should mention it by name and describe what happens when a link on it is followed. This is a short paragraph, but it is the difference between a documented practice and an undisclosed one, and it is the first thing anyone reviewing you will look for.

Cover what is recorded, why, how long it is kept and who it is shared with. If a third-party platform operates the redirect, say so, because the person clicking is interacting with that platform whether or not they know it.

Vendor settings are part of your posture

A link platform may offer device-level detail, third-party integrations, or pixel injection. These are configuration choices you are responsible for, not defaults imposed on you. Review what is switched on, particularly on accounts that have accumulated settings over several years and several owners.

Ask the provider where data is stored, what sub-processors are involved and what the deletion path looks like. If you cannot answer those three questions about your own links, you cannot answer them for anyone who asks, and someone eventually will.

Design for the version you would be comfortable explaining

A useful test is whether you would be content to describe your click analytics, in plain language, to the person who clicked. Counting clicks per campaign passes easily. Building a persistent profile of an individual's link history to sell to a third party does not, and the discomfort is a reliable signal well ahead of any legal analysis.

Most teams find that applying this test costs them nothing they were using. The reports they rely on are aggregate, and the identifying detail was collected because a checkbox was on, not because anyone needed it.