First-Party Session Analytics Platform

Challenge

Most websites rely entirely on third-party tracking, with little transparency about what is collected and no ownership of the data. Visitors want privacy controls, the business wants its own data, and UK GDPR wants a documented basis for both.

Approach

A first-party analytics platform with two tiers. With consent, structured session data is sent to a C# API and stored in a dedicated Azure SQL database. Without it, a consent-free tier records page views, scroll depth, errors and web-vitals with no persistent visitor identifier, under a legitimate-interest basis that is written down in the privacy policy. The server enriches each session — country, language, device, and an acquisition channel (paid, organic, social, email, referral or direct) decided by a clear precedence of click IDs over campaign parameters over referrer — and flags crawler and monitoring traffic so reporting can exclude it. Session duration and exit page are derived from lifecycle events rather than client-side timers. Every write is idempotent, and a conversion that arrives before its session is recorded against a stub rather than silently dropped. Microsoft Clarity is correlated through shared session tags, and Search Console queries are ingested into the same store.

Outcome

• All analytics data held in the business's own infrastructure, queryable with SQL
• Consent explicit and auditable; the consent-free tier documented and minimal
• Every session since September 2026 (to 15 October) classified by channel on the server, with bot traffic excludable
• No silent conversion loss, and real session durations without a JavaScript timer

Where judgement mattered

• Two consent tiers with a documented lawful basis, instead of "track everything" or "track nothing"
• Classifying channel on the server, where the rules can be tested, rather than in every client
• The stub-session guard: fire-and-forget beacons must never fail a foreign-key check and vanish