Cookies and tools like Google Analytics that identify or track visitors involve processing personal data. An online identifier counts as personal data under section 2 of the Data Protection Act, 2024, so the Act’s ordinary rules apply to a website the same way they apply to a customer database: you need a lawful basis, and you need to tell people what is happening.
If you run a Botswana business website with analytics installed and you have been wondering whether that alone puts you at risk, the honest answer is: not the analytics itself, but very likely how it was implemented.
Not all cookies are the same
Strictly necessary cookies, the ones that keep a shopping cart working or a login session active, typically rely on the “necessary for performance of a contract” basis. See lawful processing for where that basis sits among the others. These do not need the same kind of consent banner treatment, because the site genuinely cannot do the thing the visitor is there for without them.
Analytics and advertising cookies or scripts are a different category. Google Analytics, Meta Pixel, and similar tools track behaviour across a session, and sometimes across visits, purely to build a profile of how the site is used or to target advertising. That is not necessary for the visitor to use the site, so it typically needs consent rather than resting on contract necessity.
What a compliant approach actually looks like
The bar is not a popup that exists for its own sake. It is telling visitors clearly what is being collected and why, ideally before any non-essential tracking starts, and then actually honouring their choice if they decline. A banner that says “we use cookies” with an “OK” button and no real option to refuse is not doing what the Act asks for, even though it looks, superficially, like the industry-standard thing to have.
The most common, genuine gap Digital Thread sees is a cookie banner that fires Google Analytics immediately on page load, regardless of what the visitor eventually clicks. By the time someone declines, the tracking script has often already run. That is not a small technical detail, it defeats the entire point of asking in the first place.
That is not a small technical detail, it defeats the entire point of asking in the first place.
Analytics tools usually mean an international transfer too
Using Google Analytics, or almost any similar overseas-hosted tool, typically sends visitor data to servers outside Botswana. That is a separate issue on top of consent: it is an international data transfer, and it carries its own conditions under the Act. See international data transfers for what those conditions are and how a business actually meets them in practice.
Where this needs to be disclosed
Cookies, analytics tools, and any resulting international transfer are exactly the kind of thing a privacy policy is supposed to cover. If your site’s privacy policy does not mention that it uses Google Analytics, where that data goes, or what choice a visitor has about it, that is a gap worth fixing directly. See what should a privacy policy contain for the full list of what belongs there.
The practical takeaway
Having Google Analytics on your site is not, by itself, a compliance problem. Firing it before a visitor has made any real choice, and not disclosing it anywhere, is. If you already have analytics installed, the useful next step is checking exactly when the tracking script actually loads relative to the consent banner, not just whether a banner exists.
