Privacy is the topic where admins reflexively recommend calling a lawyer. But half of GDPR compliance is technology — and the other half is documenting that technology. Handle both yourself and save the expensive consultation for the genuinely tricky cases.

This article shows real configs for nginx and Apache, how Matomo runs without cookies, and why you need a log rotation strategy. Everything I run on bitcalc.net itself.

IP anonymization: the easiest lever

An IP address is personal data. Masking the last octet makes it harmless — one line:

# nginx: anonymize last octet of client IP
map $remote_addr $anonymized_ip {
    ~(?P<ip>\d+\.\d+\.\d+)\.\d+ $ip.0;
    default 0.0.0.0;
}

For Matomo, set IP anonymization to 2 bytes in settings. 203.0.113.42 → 203.0.0.0. Statistically useful, personally worthless.

Matomo cookieless: analytics without consent banners

Run Matomo without cookies. Then you need no consent banner for analytics:

_paq.push(['disableCookies']);  // ← This line
bitcalc does exactly this. Matomo runs cookieless on a subdomain, IPs anonymized to 2 bytes, and the consent banner only handles AdSense. Analytics runs completely consent-free.
GDPR checklist for website operators: IPs, logs, cookies, consent

Log rotation and retention periods

GDPR requires you not to keep personal data longer than necessary. logrotate with a 14-day retention covers error analysis while staying compliant. Document exceptions for security incidents.

Cookie consent: only collect what you need

Load scripts only after consent. bitcalc sets exactly one technical cookie (bitcalc_lang) under legitimate interest — no consent needed. Everything else (AdSense) runs with opt-in only.

Data processing agreements: hosting, CDN, fonts

Every external service needs a DPA. bitcalc self-hosts all assets — Inter and JetBrains Mono as local TTF files, no external font downloads. That eliminates an entire DPA situation.