Website Analytics for Small Businesses: What to Measure

• Analytics is not a scoreboard. For a small business it exists to answer two questions: are the right people arriving, and do they do anything once they get here.
• Google Analytics 4 and Google Search Console measure different halves of the same problem. Search Console tells you what happened in Google before the click; GA4 tells you what happened on your site after it. You need both, and they will not agree.
• Five numbers are enough to run a small site: enquiries, where visitors came from, which pages they landed on, which Google queries brought them, and where they leave.
• The ICO's guidance, finalised 29 April 2026, sets out five exceptions to the consent rule, including a "statistical purposes" exception for aggregate analytics — narrow, conditional, and not a licence to track individuals.

Website analytics is the record of what people did on your website: which pages they opened, how they got there, what they clicked, and whether they ever contacted you. That is all it is. It is a log, not a verdict.

The trouble starts when a small business treats that log as a performance rating. Most analytics advice is written for companies with a marketing department to interpret it. If you run a plumbing firm, a salon or a two-person consultancy, you need to know whether last month produced more enquiries than the month before, and roughly why.

So the useful framing is narrow. Are the right people arriving — the ones near you, searching for what you actually sell? And once they arrive, does anything happen: a call, a form, a booking? Every number that does not help answer one of those is decoration, and plenty are worse than decoration, because they cost you attention.

There is a second use, quieter but real: analytics tells you when something has broken. A page that was getting visits and stops. A form that used to produce enquiries and now produces none. You will notice a broken website; you will almost never notice a broken enquiry path without a record to compare against.

1. Enquiries. Form submissions, calls, bookings — the thing that turns a visitor into a conversation. In GA4 these are set up as key events. If you measure nothing else, measure this, and check the count against your inbox. A form that silently stops sending email will still register perfectly in analytics.

2. Where visitors came from. Google's organic results, Google Maps, a Facebook post, a directory, someone typing your name in. Channel matters more than volume: two hundred visits from an unrelated forum thread are worth less than twenty from people searching for your service in your town.

3. Which pages people land on. The landing page did the work of getting them there. If your homepage is the only page that ever brings anyone in, your service and location pages are not earning their keep.

4. Which Google queries you appear for. This lives in Search Console, not GA4, and it is the single most useful report a small business has. It shows the words real people typed before they saw you.

5. Where people leave. Exit pages tell you where the path breaks. A contact page with plenty of visits and no submissions is a specific, fixable problem.

What to ignore: total page views as a headline, "average time on page" for any single visitor, anything described as an industry benchmark, and — with one caveat below — bounce rate.

Google describes Search Console as "a free service offered by Google that helps you monitor, maintain, and troubleshoot your site's presence in Google Search results". It measures the search results page. GA4 measures your website. The join between them is the click.

Search Console reports four things about that click. An impression is when "someone saw a link to your site on Google". A click is when "someone clicked a link from Google to your site". Average position is "a relative ranking of the position of your link on Google, where 1 is the topmost position". Click-through rate is "the calculation of (clicks ÷ impressions)". The report's default view shows the past three months.

That gives you a useful diagnostic. High impressions and low clicks means Google shows you but nobody picks you — usually a title and description problem. Low impressions means you are not in the running at all, which is a content and relevance problem no page-title tweak will fix.

GA4 picks up after the click, and its engagement metrics are worth understanding properly because the names mislead. Google counts an engaged session as one that "lasts longer than 10 seconds, has a key event, or has 2 or more screen or page views". Engagement rate is "the percentage of engaged sessions". Bounce rate in GA4 is simply "the percentage of sessions that were not engaged" — the inverse of engagement rate, not the old measure of single-page visits. A visitor who reads your services page for four minutes, finds your phone number and rings you counts as engaged. Under the older definition it looked like a failure, which is why chasing a bounce-rate number is a poor use of a Tuesday.

Two more things worth knowing. GA4's data-retention setting for user-level and event-level data on standard properties is two or fourteen months, and Google notes it "does not affect standard aggregated reports" — only explorations and funnel reports. And the two tools will not match. Google says plainly that "the data displayed in Search Console may differ from the data displayed in other tools, such as Google Analytics", and that Search Console data normally becomes available in two to three days. Search Console also omits rare queries to protect privacy, so the query list will never add up to the total. Do not spend an evening reconciling them.

First, a correction that catches people out: the rules are not about cookies. The ICO's guidance covers "storage and access technologies" and states that PECR applies to "any technology that stores information, or accesses information stored, on a subscriber's or user's 'terminal equipment'", listing cookies, tracking pixels, link decoration and navigational tracking, web storage, fingerprinting techniques, and scripts and tags. Swapping a cookie for local storage or a fingerprint changes nothing legally.

The ICO finalised this guidance on 29 April 2026. It sets out five exceptions to the prohibition on storing or accessing information on someone's device: communication, strictly necessary, statistical purposes, appearance, and emergency assistance. The third is the one that matters here — the ICO calls it the "statistical purposes" exception, and also "the 'analytics' exception". It applies where "the sole purpose of the storage and access technology is collecting information for statistical purposes about the use of your service", and the ICO is explicit that it "is about how your service is used, not about who uses it. It is not for identifying, tracking or monitoring people".

The conditions are real. You must give users "clear and comprehensive information" about the purpose and "a simple means of objecting, free of charge". The information must be aggregated, and you must not retain individual-level records afterwards. The ICO's own examples of activities likely to meet the exception include total visits page by page, scroll depth, device and browser types, how users reached your service, A/B testing, coarse geolocation at city or region level, and page loading speeds. Its examples of activities that still need consent include recordings or logs of individual visitors, measuring whether someone saw or clicked an advert, connecting a visitor ID to site activity, and monitoring browsing across different services.

We are describing what the ICO's guidance says, not advising you on it. Read it yourself, or take advice, before relying on any exception.

On our own site we take the cautious route on both counts. GA4, Google Tag Manager and Microsoft Clarity are consent-gated — nothing fires until a visitor gives analytics consent through our banner, and preferences can be changed at any time from the footer. Google's consent mode is what makes that behave sensibly rather than simply going blind: Google's documentation describes consent types including `analytics_storage`, and says that where consent is denied, "tags that fire do not store cookies, instead they communicate a minimum of information about user activity". Google also states that "Google Analytics does not log or store individual IP addresses from EU, Switzerland, or UK users".

Separately, we keep our own cookie-free first-party record of page views and interactions in our database. It stores nothing on the visitor's device and is not linked to anyone's identity unless they submit a form, as set out in our cookie policy and privacy policy. The benefit is not privacy theatre: our traffic picture has no hole in it the size of everyone who declined the banner. That is the honest argument for first-party measurement — coverage, not just compliance.

Work in this order.

Start at the bottom. Enquiries first. How many, from where, and did they turn into work? If enquiries are up, nothing else in the report is bad news. If they are down, everything else is a clue.

Compare like with like. Month against the same month last year, not against last month. Trades and local services are seasonal, and a December dip is a calendar, not a crisis.

Look for the single biggest change. One channel, one page, one query — not the whole table. Most months have one story in them.

Read Search Console queries. Look for terms you did not expect. New queries appearing are the earliest signal that content is landing; queries you rank for but get no clicks on are your quickest wins.

Check the pages that lost. A page that dropped is more informative than one that rose, because something specific caused it.

Then stop. Two or three actions is a good month's output.

If you would rather someone else did this, our SEO Care plans at £95, £175 and £295 a month include a monthly performance report as part of ongoing SEO and content work. Worth being clear about the boundary: WebsiteCare is our hosting, security and maintenance service and includes no analytics or reporting. They are separate services because they are separate jobs.

Measuring traffic instead of enquiries. A month with fewer visitors and more enquiries is a better month, and it will look worse on every default dashboard.

Installing the tag and never looking again. GA4 with no key events configured records visits and nothing about outcomes. Set up the form submission and the phone-number click, or the data is a diary of strangers.

Reading noise as trend. On a small site, a week is not a sample. Compare months, and expect movement in both directions.

Trusting one tool's number as truth. Analytics counts sessions, your inbox counts enquiries, your bank counts customers. When they disagree, the further down that list you go, the more you should believe it.

Blocking your own measurement without meaning to. If your consent banner blocks Google's tags entirely rather than using consent mode, declined visits vanish from the record. A legitimate choice, but make it knowingly.

What is website analytics in simple terms?

Website analytics is a record of what visitors did on your website — which pages they opened, how they arrived, and whether they contacted you. For a small business it is best used to answer two questions: are the right people arriving, and does anything happen when they do. Most of the numbers a default dashboard shows you will not change a decision. The version worth keeping is short: enquiries, traffic sources, landing pages, search queries and exit pages.

Do I need both Google Analytics and Search Console?

Yes, because they measure different things. Google describes Search Console as a free service that helps you monitor, maintain and troubleshoot your site's presence in Google Search results, so it covers what happened before the click — impressions, clicks, click-through rate and average position. Google Analytics 4 covers what happened after the click. Search Console is the more useful of the two for a small local business, because it shows the actual words people searched. Both are free.

What is a good bounce rate in GA4?

There is no good number, and the metric no longer means what most people think. Google defines an engaged session as one that lasts longer than ten seconds, has a key event, or has two or more page views, and bounce rate in GA4 is simply the percentage of sessions that were not engaged. Someone who reads one page thoroughly and then rings you is counted as engaged, not as a bounce. Ignore benchmark figures and watch your own enquiry count instead.

Can I track website visitors without cookies?

Technically yes, but the legal question is broader than cookies. The ICO's guidance says PECR applies to any technology that stores information, or accesses information stored, on a user's device, and lists cookies, tracking pixels, link decoration, web storage, fingerprinting and scripts and tags. Aggregate first-party measurement that stores nothing on the device is a genuine option, and it has the practical advantage of not losing the visitors who decline a banner. This is a description of the guidance, not legal advice.

Do analytics cookies need consent under UK law?

The ICO's finalised guidance of 29 April 2026 sets out five exceptions to the consent requirement, one of which is the statistical purposes exception, also called the analytics exception. It applies where the sole purpose is collecting statistical information about how your service is used in order to improve it, and it requires clear and comprehensive information plus a simple, free means of objecting. The ICO states it is about how your service is used, not who uses it, and that it does not cover tracking individuals, session recordings, or advertising. Read the guidance or take advice before relying on it.

How often should I look at my website analytics?

Once a month suits most small businesses, with a five-minute check of Search Console after you publish something new. Anything more frequent turns normal variation into false alarms — a small site does not produce enough data in a week to show a trend. Compare each month against the same month last year, and give yourself a limit of two or three actions per review.

• Free resources and guides — our library of practical guides for small business owners.
• SEO checklist — the on-page checks worth doing before you worry about measurement.
• SEO Care — ongoing SEO and content work, with a monthly performance report.
• Local SEO complete guide — how local search visibility is built, and what Search Console shows you about it.
• Cookie policy — our own consent posture, and every script we run, set out in full.