A standard analytics snippet, installed with defaults, captures page URLs, referrers, device details and often the contents of form fields and page elements. URLs frequently carry identifiers, email addresses and search terms. All of it goes to a third party, usually outside India.
Under the DPDP framework this is processing of personal data, which needs a basis, and a transfer to a processor, which needs terms. Most teams have neither, not through negligence but because installing analytics does not feel like a data-sharing decision.
The first fix costs nothing: stop sending what you do not need. Strip query parameters from recorded URLs, mask form inputs by default, and turn off automatic capture of element text. Most platforms support all three and most installations use none of them.
Server-side collection gives more control. Events sent from your backend rather than the user's browser mean you decide exactly what leaves your systems, and the analytics vendor never sees the user's IP address or browser fingerprint. It is more work to implement and it removes a whole category of accidental leakage.
Self-hosted options — Plausible, Matomo, PostHog among them — keep the data on infrastructure you control. The trade is operational: you now run and back up an analytics system. For teams already running infrastructure, that cost is smaller than it appears, and it turns a data transfer question into a data storage question.
Whichever route, write down what you collect and why. Producing that list usually reveals a handful of events nobody looks at and one or two that capture more than intended. Removing them is both a privacy improvement and a simplification, which is a rare combination.
