Web Analytics
Web Analytics and Website Analytics: Two Names, One Practice
Web analytics is the practice of collecting, processing, and interpreting data about how people reach and use a website, so that decisions about the site and its marketing rest on evidence rather than on guesswork or habit. You will also see it called website analytics. This glossary treats the two names as one practice, because both describe the same work: measuring a site, then acting on what that measurement shows.
A working definition
Every web analytics setup does three jobs. It collects interactions such as page views, clicks, form submissions, and purchases. It processes those records into units like users and sessions. Then it reports them so someone can compare channels, pages, and time periods. Collection alone is not analysis. A tag that fires correctly but feeds a dashboard nobody reads has measured activity without improving anything on the site.
Where web measurement ends and data analytics begins
Web analytics is narrower than data analytics, which covers structured analysis of any business data, from CRM records to financial reports. Web analytics stays focused on the website itself: where visits come from, what people do on the pages, and which on-site actions count as outcomes. A specific product such as Google Analytics is one way to do that work, not the definition of it. Google Analytics is widespread, with W3Techs detecting it on 46.8% of all websites and on 82.1% of sites whose traffic analysis tool it can identify (technology detection survey, global, snapshot dated 19 October 2026, VERIFIED). Widespread does not mean universal. The concepts below apply whichever tool a site uses.
How Website Data Gets Collected
Collection method decides what reports can see. Two sites with identical traffic can produce different numbers simply because one relies on a browser script while the other reads its server logs.
Browser tags and events
Most modern tools load a small script in the visitor's browser and send an event each time something measurable happens. Google's documentation describes an event as a way to measure a specific interaction or occurrence, such as a page load, a link click, or a completed purchase (About events, Google Analytics Help). Some events are collected automatically, while others must be defined and implemented by the site owner. Tags are often deployed through a tag manager such as Google Tag Manager, which keeps measurement code separate from the main codebase.
Server logs and server-side collection
Web servers record every request they receive, and some tools build reports from those logs instead of from browser scripts. Each method sees different things. Matomo's documentation notes that log files include requests from visitors who use ad blockers and also contain search engine and spam bot activity, while its JavaScript tracker is needed for features like ecommerce tracking, heatmaps, session recordings, and form analytics, and log analysis tends to over-report (Matomo FAQ, vendor methodology). Server-side collection changes where data is processed. It does not change visitor consent. A visitor who blocked tracking or declined cookies made a choice, and routing the same data through a server does not undo that choice.
| Question | Browser tag | Server log | Server-side collection |
|---|---|---|---|
| Where is data captured? | A script in the visitor's browser sends an event for each measurable interaction. | The web server records every request it receives. | Data is processed on a server, which changes where processing happens. |
| Visitors using ad blockers or tracking protection | Can be missed when the script is blocked. | Their requests still appear in log files. | Routing data through a server does not undo a visitor's choice to block tracking. |
| Bot activity | Many tools filter identified bots before reporting. | Logs contain search engine and spam bot requests. | Depends on filter settings, which can change. |
| Ecommerce tracking, heatmaps, session recordings, form analytics | Available through a JavaScript tracker. | Require a JavaScript tracker, per Matomo's documentation. | Not covered in this entry. |
| Main caveat | Blocked scripts and declined consent leave gaps. | Log analysis tends to over-report. | It does not change what a visitor agreed to. |
Testing collection before trusting it
A broken tag fails quietly. Duplicate purchase events inflate revenue, and a form tracker that fires on a button click rather than on a confirmed submission counts attempts as leads. Google's event documentation points to its Realtime report and DebugView as ways to confirm that an event and its parameters arrived as intended. Run that kind of check whenever a tag, form, or checkout step changes, not only at launch. Teams planning a rebuild can put this testing on the launch checklist of their website design and development project instead of treating measurement as an afterthought.
Metrics Only Mean What Their Definitions Say
Labels travel well between tools. Definitions do not. The same word, whether "session" or "user," can describe different counting rules depending on the platform and its settings.
Users, sessions, and events are counting rules, not head counts
Google Analytics describes a session as a period of user interaction that, by default, ends after 30 minutes of inactivity, and it notes that session counts in its standard reports are estimated, so they can differ slightly from exact counts in a raw data export (About Analytics sessions, Google Analytics Help). Its user metrics are split into total, active, new, and returning users, each with its own rule (Understand user metrics, Google Analytics Help). These counts track identifiers, not people. One person on two devices can appear as two users, and a person who blocks tracking may not appear at all.
Engagement and the redefined bounce rate
Bounce rate is the clearest example of a familiar label with a changed meaning. In Google Analytics 4, an engaged session lasts longer than 10 seconds, includes a key event, or has at least two page or screen views, and bounce rate is simply the share of sessions that were not engaged (Engagement rate and bounce rate, Google Analytics Help). Older tools commonly treated any single-page visit as a bounce. Numbers calculated under those two rules should not share a trend line.
Outcomes before traffic volume
Traffic and engagement explain how an outcome happened. They are not the outcome. Start with the action the site exists to produce, such as a purchase, a qualified inquiry, or a completed application, and define the event that confirms it. Then specify the denominator. A conversion rate calculated per session and one calculated per user answer different questions, even when both reports use the same label.
Why Measured Data Is Never Complete
Every analytics report is a partial record. Some visits are never recorded, some recorded activity is not human, and some numbers are estimates rather than observations. Knowing which of these applies to a given report matters more than chasing a perfectly complete dataset.
Consent, modeled data, and privacy rules
When visitors decline analytics cookies, a consent-aware setup stops associating their activity with a persistent identifier. Google Analytics can fill part of that gap with behavioral modeling, which estimates the behavior of users who declined consent from similar users who accepted, but only for properties that meet documented eligibility thresholds, and modeled data is excluded from features such as audiences, retention reports, and BigQuery exports (Behavioral modeling for consent mode, Google Analytics Help). Modeled numbers are estimates. They are not recovered browsing history.
In the United States, the rules depend on the business and the state. California's CCPA gives residents the right to opt out of the sale or sharing of their personal information, including through a browser signal called Global Privacy Control, and it applies to for-profit businesses that meet thresholds such as gross annual revenue above $26,625,000 (California Privacy Protection Agency, CCPA monetary thresholds effective 1 January 2025). The FTC's Office of Technology has also warned that tracking pixels can send form inputs and purchase details to third parties, that blocking third-party cookies may not fully stop them, and that impermissible disclosure of personal information through pixels may violate the FTC Act (FTC Technology Blog, March 2023). Treat this as context, not legal advice.
Browser protections and blocked tags
Some browsers block analytics scripts outright. MDN's page on Firefox tracking protection explains that, in Private Browsing windows, Firefox blocks content from domains on a list of known cross-site trackers, so sites cannot use third-party analytics services that engage in that tracking (Firefox tracking protection, MDN, last modified 6 June 2025). Ad blockers and privacy extensions have a similar effect. The visit still happened. The report simply never heard about it.
Visits that never happen: AI answers and zero-click search
A growing share of searches now ends without a website visit. SparkToro's analysis of Similarweb clickstream data found that 68.01% of US Google searches ended without a click from January through April 2026, compared with 60.45% in 2024, although the two years were measured on different clickstream panels (zero-click rate, United States, vendor methodology, VERIFIED) (SparkToro, June 2026). When people do click through from chatbots, some tools now label it. Google Analytics added an AI Assistant channel on 13 May 2026 that assigns an "ai-assistant" medium when the referrer matches a recognized assistant such as ChatGPT, Gemini, or Claude (What's new in Google Analytics). Influence that never produces a click stays invisible to web analytics.
Bot and agent traffic
Not every recorded visit comes from a person. Thales reported that bots made up more than 53% of all web traffic in 2025, up from 51% the previous year, with human activity at 47%, and that AI agents are emerging as a third category of traffic alongside traditional good and bad bots (share of web traffic, global, vendor methodology based on Thales Threat Research data, VERIFIED) (Thales 2026 Bad Bot Report announcement, April 2026). That figure describes traffic across the network Thales observes, not what any single analytics tool records, because many tools filter identified bots before reporting. Bot filtering is itself a changeable setting.
Did Performance Change, or Did the Measurement Change?
Before crediting a campaign or a redesign with a jump in conversion rate, confirm that the measurement itself stayed the same across both periods being compared. This check is easy to skip.
Changes that break period comparisons
Shopify offers a documented example. Its session measurement update, rolled out from September 21 to 23, 2026, changed how sessions end, counted some sessions that had no page view, and filtered identified bot sessions by default, and Shopify states that orders, sales, and customer counts were not affected (Changes to sessions and conversion rate in Shopify Analytics). Because conversion rate is calculated from sessions, it can rise or fall without any change in orders. Shopify advises treating data after the update as a new baseline. The same logic applies to any platform migration, consent banner launch, tag rewrite, or filter change.
Keeping a measurement change log
A short, dated log turns this check into a habit. Record each of these changes with the date, the owner, and the metrics it may affect:
| Change type | What to record | Metrics it can shift | Why it matters |
|---|---|---|---|
| Tag, trigger, or event definition changes, including renamed or retired events | Date, owner, old and new trigger, events affected | Event counts, key events, revenue, leads | Duplicate purchase events inflate revenue, and a tracker that fires on a button click counts attempts as leads. |
| Consent banner launches, wording changes, and default settings | Date, owner, banner version, regions covered | Users, sessions, share of modeled data | Declined consent removes persistent identifiers, and modeling fills only part of that gap for eligible properties. |
| Bot, internal traffic, and hostname filters added or removed | Date, owner, filter rule before and after | Sessions, conversion rate, bounce rate | Shopify's default bot filtering changed session-based metrics while orders, sales, and customer counts stayed the same. |
| Session timeout, engagement timer, and attribution setting changes | Date, owner, old and new value | Sessions, engaged sessions, bounce rate, channel credit | Session counts depend on the timeout rule, bounce rate depends on the engaged-session rule, and credit depends on the attribution model. |
| Platform updates, migrations, and reported data outages | Date, platform notice, affected period | Any session-based metric, period-over-period comparisons | After a documented measurement update, Shopify advises treating later data as a new baseline. |
When a metric moves, check the log first. If the movement lines up with a logged change, compare the outcomes that the change could not touch, such as orders or confirmed inquiries, before reading anything into the trend.
Attribution Records Credit, Not Cause
What attribution models assign
Google defines attribution as assigning credit for important user actions to the ads, clicks, and other factors along a user's path, and its reporting attribution model can be a rule, a set of rules, or a data-driven algorithm (Select attribution settings, Google Analytics Help). That is bookkeeping, and useful bookkeeping. An attribution model divides credit among touchpoints that were present before a conversion. It cannot say whether that conversion would have happened without them.
When an experiment is the better test
To learn whether a change caused a result, compare a group that received it with a group that did not. Microsoft researchers describing their online experimentation platform note that randomization and proper design allow experiments to establish causality, which is why controlled experiments are the standard in drug trials (Online Experimentation at Microsoft, Microsoft Research). For websites, that usually means an A/B test with a clear success metric agreed before launch. Observational reports remain useful. Label their findings as associations.
Web Analytics FAQs
What is web analytics?
Web analytics is the collection, processing, and analysis of website data to understand where visitors come from, what they do, and which actions lead to business outcomes. Its purpose is better decisions about the site and its marketing.
Is website analytics different from web analytics?
This glossary treats them as the same practice. Both names describe measuring a website and acting on the results, so a single entry covers both terms.
How does web analytics work?
A collection method, usually a browser script or server logs, records interactions. The tool processes them into metrics such as users and sessions, then presents reports. The method chosen determines which interactions are visible.
Why do two analytics tools show different numbers?
They can define sessions differently, count or filter bots differently, use different time zones, and lose different visitors to blockers or declined consent. Shopify's discrepancy guide lists several of these causes. Compare definitions before comparing totals.
Can web analytics work without cookies?
Partly. Server log analysis does not depend on browser cookies, but it offers less detail on behavior and identity. Collecting data without cookies does not by itself make a setup compliant with privacy law.
Does web analytics prove that marketing caused a conversion?
No. Analytics records activity, and attribution assigns credit. Showing that marketing caused additional conversions requires a comparison group, ideally from a randomized experiment.
