Privacy-enhancing technologies have moved from academic papers into everyday web stacks, and anyone running a site with analytics, forms or advertising tags now has to decide which of them actually reduce legal risk. This article explains how privacy-enhancing technologies (PETs) support site compliance under GDPR and similar laws, where they fall short, and how to roll them out without creating new gaps. The goal is simple: collect the data your business needs while exposing as little personal data as possible to vendors, attackers and regulators.
What Counts as a Privacy-Enhancing Technology on a Website
PETs are technical measures that minimise, protect or transform personal data before it is used. On a typical marketing or eCommerce site, the relevant ones are fairly practical. Academic techniques like homomorphic encryption rarely show up.
The tools that matter most in day-to-day website compliance tend to be:
- Pseudonymisation and hashing – replacing identifiers such as emails or user IDs with tokens or SHA-256 hashes
- IP truncation and anonymisation – dropping the last octet of IPv4 addresses before storage, as Matomo and many CDNs offer
- Server-side tagging – routing tracking through your own endpoint, for example server-side Google Tag Manager, so you can strip fields before data reaches third parties
- Cookieless or aggregate analytics – tools like Plausible, Fathom or Matomo in cookieless mode that report totals instead of building user profiles
- Differential privacy and aggregation thresholds – adding statistical noise or suppressing small groups, the approach used by the US Census Bureau for the 2020 census
Encryption in transit and at rest technically belongs here too. Most teams already treat TLS as baseline hygiene rather than a PET decision, though.
How Privacy-Enhancing Technologies Map to Legal Obligations
GDPR never says “use PETs.” It does require data protection by design and by default under Article 25, data minimisation under Article 5(1)(c), and appropriate security under Article 32, which names pseudonymisation and encryption directly. PETs are the most concrete way to show a regulator you took those articles seriously.
The benefit is measurable. A server-side tagging setup that removes IP addresses, user agents and URL query parameters before forwarding events to Meta or Google Ads shrinks what you share with each vendor. It also makes your third-party script footprint easier to defend, because you control the payload rather than a vendor’s JavaScript.
International transfers are where PETs carry the most legal weight. After the Austrian DSB ruled against a site’s use of Google Analytics in January 2022, the “supplementary measures” debate became practical. The EU-US Data Privacy Framework, adopted in July 2023, eased pressure for certified US vendors. Transfers to non-certified recipients still rely on Standard Contractual Clauses plus a transfer impact assessment. Strong pseudonymisation, where the recipient cannot re-identify anyone, is one of the few supplementary measures the EDPB has accepted as effective.
The Myth That Hashed Data Is Anonymous
This is the misconception that causes the most trouble. Marketing teams often believe that sending a SHA-256 hash of a customer’s email to an ad platform means “no personal data leaves the building.” It doesn’t work that way.
A hash of an email address is pseudonymised data, not anonymous data. The ad platform hashes its own users’ emails the same way and matches them. That matching is the whole point of features like Meta’s Advanced Matching or Google’s Enhanced Conversions. Under Recital 26 of GDPR, data that can be linked back to a person with reasonably available means stays personal data. The EDPB’s 2025 pseudonymisation guidelines reinforced the same point.
The practical consequence: hashed uploads still need a lawful basis, still need consent where ePrivacy applies, and still belong in your privacy policy and records of processing.
Rolling Out PETs Step by Step
An experienced privacy engineer or DPO doesn’t start by buying a tool. They start by mapping the data flows. A sensible sequence for a mid-sized site:
First, inventory every script, pixel and form endpoint. Record what each one sends and to whom. Browser DevTools and a HAR export from a few typical user journeys usually reveal 20-40 outbound domains on a marketing-heavy site.
Second, classify each flow by purpose and ask whether the purpose survives with less data. Conversion counting rarely needs a full IP address. Fraud prevention might.
Third, choose the PET that fits each flow. Move ad conversions to server-side tagging with field stripping. Switch basic traffic analytics to an aggregate tool, or configure Matomo with IP anonymisation set to 2 bytes. Pseudonymise CRM exports before they reach BI tools.
Fourth, document the decision. Note the residual risk, the legal basis and whether consent is still required. Then test in staging before production.
Finally, re-verify after every tag manager publish or CMS update. A single container change can quietly undo a month of minimisation work.
Common Mistakes Teams Make With PETs
Treating server-side tagging as a consent bypass. Moving a Meta pixel to a server container doesn’t remove the need for cookie consent if you still set or read identifiers on the user’s device. Some agencies sell server-side setups as “cookie banner–free tracking.” Regulators in France and Germany have taken a dim view of that framing. The guidance on marketing pixels and conversion tracking applies whether the request leaves the browser or your server.
Configuring the PET once and never checking it again. IP truncation gets switched off during a debugging session and stays off. A new GA4 property gets created without the same data retention settings. Anonymisation that nobody monitors tends to stop working without anyone noticing.
Assuming the vendor’s “privacy-friendly” label settles the question. Cookieless analytics tools differ a lot. Some use a daily rotating hash of IP plus user agent. Others use fingerprinting-adjacent techniques that a strict regulator could still consider tracking. Read the technical documentation, not the landing page.
When Standard PET Advice Doesn’t Apply
Healthcare and financial sites face sector rules that override general guidance. Under HIPAA, even a pseudonymised appointment-booking event sent to an ad platform can be an impermissible disclosure. The US HHS bulletin on online tracking technologies made that clear in 2022-2024.
Small teams of under 10 people often get more compliance value from removing a tool entirely than from engineering a PET around it. If nobody reads the heatmaps, delete the script. Sites that serve mostly non-EU markets need to check local laws as well. Brazil’s LGPD and Canada’s PIPEDA treat anonymised and pseudonymised data differently in their wording, so a setup tuned for GDPR may not translate cleanly.
FAQ
Do privacy-enhancing technologies remove the need for a cookie banner?
Not automatically. If the technology avoids storing or reading information on the user’s device, as truly cookieless aggregate analytics does, consent may not be needed in many EU countries. Server-side tagging that still uses client identifiers does require consent.
Is pseudonymised data still covered by GDPR?
Yes. Pseudonymised data remains personal data. It lowers risk and can support transfer assessments and security obligations, but every GDPR duty still applies to it.
Which PET gives the biggest compliance improvement for a typical website?
For most marketing-driven sites, server-side tagging with strict field stripping gives the largest single reduction in data shared with third parties. Pair it with IP truncation in analytics.
Summary
Privacy-enhancing technologies give website owners concrete evidence of data protection by design, reduce exposure to vendors and strengthen international transfer arrangements. They don’t replace consent, legal bases or transparency, and hashed data stays personal data. Map your data flows first, match each one to a PET that fits its purpose, and document the reasoning. Then check after every release that the protections are still running, because a PET that has silently stopped working does nothing for compliance.