Google Analytics alternatives that need no cookie banner
For a small business site that wants traffic numbers without asking every visitor for consent. Google Analytics 4 against 6 privacy-first analytics tools, measured on what decides whether the EU’s device rule needs a banner and what counts as “sharing” under the California law, from each vendor’s own documentation. read 2026-10-22
Best overall
Plausible
The only one whose own pages say yes on every row: no device storage, a daily salt, EU hosting and a DPA you accept without signing.
Best for collecting the least
Simple Analytics
No visitor ID and no IP address, not even a hashed one; the trade is no returning-visitor counts and no DPA.
Best for keeping data on your own server
Matomo
Full reports on your own infrastructure or in Frankfurt; switch its cookies off first, because they are on by default.
The requirements, tool by tool
Each row is something the EU device rule, the GDPR or the California law asks about, with the article or section it comes from. GA4 sits in the first column as the baseline. Read across for one requirement; read down for one tool. If you are weighing a product-analytics suite instead, our PostHog vs Google Analytics page compares that switch.
| Requirement | Google Analytics 4 | Plausible | Fathom | Simple Analytics | Matomo | Pirsch | Umami |
|---|---|---|---|---|---|---|---|
| Stores nothing on the visitor’s deviceePrivacy Art. 5(3) | no_ga cookies | yes | yesno tracking cookies | yes | nocookies on by default | yesno cookies | yesno cookies |
| Recognises a visitor for one day at mostGDPR Art. 4(1) (online identifier) | no_ga: 2 years | yesdaily salt | yesdaily salt | yesno visitor ID at all | no_pk_id: 13 months | yes | not statedID lifetime |
| Does not store visitor IP addressesGDPR Art. 4(1); Art. 5(1)(c) | yesEU, Swiss and UK traffic | yes | yeshashed; EU traffic in the EU | yesdropped, not hashed | partialmasked by default (2 bytes) | yes | yesnot in analytics records |
| Keeps the analytics data in the EUGDPR Art. 44 (transfers) | not statedcollected on EU servers | yesGermany | partialanonymised in the EU, stored in the US | yesthe Netherlands | yesCloud: Frankfurt | yesGermany | yesCloud: pick the EU region |
| Offers a data processing agreementGDPR Art. 28(3) | yes | yesaccepted by use | yessign and return | nosays it is not a processor | yesCloud DPA | yes | yes |
| Contract bars the vendor from selling or sharing the dataCal. Civ. Code § 1798.140(ag)(1)(A) | partialunder restricted data processing | yes | not statedin its DPA | partialpublic promise, no contract | yes | partialyour instructions only | yes |
| Keeps the data out of ad targeting§ 1798.140(ah)(1) and (k) | partialdepends on Google signals and ad links | yes | not stated | yes | yes | not stated | yes |
| Can run on your own serverno outside processor (Art. 28) | no | yesCommunity Edition | not stated | not stated | yesOn-Premise | not statedopen-source core | yes |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||||
Two tests a “no banner” claim has to pass
“Cookieless” answers half of one question. The EU rule is about the visitor’s device, not about cookies as such; the California rule is about where the data goes afterwards. A tool can pass one and fail the other. Our GDPR and CCPA side-by-side covers why the two laws start from such different places.
EU, ePrivacy Art. 5(3)
The device test
“…the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent…”read the text
Does the script put anything on the visitor’s device, or read anything back from it? If not, the consent rule may not reach it. If it does, consent is needed unless the access is strictly necessary for a service the visitor asked for, and regulators differ on whether counting visits is.
Answered by the rows
- Stores nothing on the visitor’s device
- Recognises a visitor for one day at most
- Does not store visitor IP addresses
4 of 7 pass on their own documentation: Plausible, Fathom, Simple Analytics, Pirsch
California, § 1798.140(ah)
The sharing test
“…a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration…”read the text
Does the analytics vendor use your visitors’ data to target ads elsewhere, or is it bound by contract not to? A vendor held to service-provider terms is not a third party you share with. One that feeds an ad network can make every pageview a sharing.
Answered by the rows
- Contract bars the vendor from selling or sharing the data
- Keeps the data out of ad targeting
3 of 7 pass on their own documentation: Plausible, Matomo, Umami
The EU data protection board’s guidelines on the reach of Art. 5(3), adopted on 7 October 2024, say that tracking built on the IP address alone can fall under the rule when the address comes from the visitor’s own equipment, even when the instruction to send it came from someone other than the party receiving it (Guidelines 2/2023, ¶ 54–55). The same text reminds readers that falling under the rule does not always mean consent is needed: an exemption may still apply (¶ 56). Fathom’s own guide puts it plainly: cookie-free design is “not a universal exemption from consent.”
So the daily-salt tools still use the IP address and user agent sent with each request to build a short-lived ID. Whether that needs consent depends on the regulator where your visitors are; Matomo points to one set of published conditions for consent-free audience measurement, from France’s CNIL. Information, not legal advice.
The banner goes when the last script that needs it goes
Swapping GA4 for a cookieless tool removes one reason for a banner. Whether the banner itself can go depends on everything else the site loads. The order that avoids a gap:
- 01
List everything that loads before a choice
Analytics is rarely the only reason for a banner. Ad pixels, video embeds, chat widgets and maps can each store or read something on the device. Run the cookie banner checklist over the site as it is today.
- 02
Pick on the rows that match your visitors
EU visitors: the first three rows. California visitors: the contract and ad-targeting rows. Both: all of them.
- 03
Put the processing terms in place
Accept or sign the vendor’s DPA before the script goes live, and for the CCPA check that it holds the vendor to service-provider terms. Our data processing agreement template lists the clauses Art. 28(3) requires.
- 04
Remove the GA4 tag and its consent settings
Take the tag out of the page or the tag manager, and its consent-mode defaults with it. Then check in your browser that no _ga cookie is set on a fresh visit.
- 05
Rewrite the notices
Name the new tool, what it collects and where it stores it in your privacy notice, and take GA4 out of the cookie list. The cookie policy template rebuilds that list.
- 06
Decide what stays
If an ad pixel still sells or shares, the “Do Not Sell or Share” link stays, and so does honoring opt-out signals: test them with the GPC checker. If nothing on the list needs consent any more, the banner can go.
Each tool in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. If you decide to keep GA4, it still needs a consent banner in front of it: our consent management platforms page compares those.
Google Analytics 4
What it is
The baseline: Google’s free analytics, read here so every alternative has something to be measured against.
Who it fits
A site that buys Google ads and wants conversions, audiences and analytics in one account, and already runs a consent banner.
What the rule requires and whether it meets it
Its tags set the _ga cookie to tell users apart, kept for two years by default, so in the EU it loads after consent. Google says it does not log or store IP addresses from EU, Swiss or UK users. It acts as a CCPA service provider only for data processed under its restricted data processing terms. Google signals, which adds signed-in Google users’ ad data, is off until you switch it on.
Check with the vendor
The pages we read do not say where Analytics data is stored once it leaves the EU collection servers. If you keep GA4, consent mode still needs a banner to talk to: Google says it does not provide one.
Plausible
What it is
A hosted, open-source analytics service run by an EU company, with a free self-hosted Community Edition under the AGPL.
Who it fits
A small business that wants a one-page dashboard, EU hosting and a processing agreement without paperwork.
What the rule requires and whether it meets it
No cookies, browser cache or local storage. Unique visitors come from a hash of a daily salt, the site domain, the IP address and the user agent; the salt is deleted every 24 hours and raw IPs are never stored. Data stays on servers in Germany. Its DPA applies on use, with no signature, and says it does not sell your data.
Check with the vendor
Its policy says you do not need a banner for analytics. That is the vendor’s reading; read the two tests below before you remove yours.
Fathom
What it is
A hosted analytics service with no tracking cookies and a separate route for EU traffic, which it calls EU isolation.
Who it fits
A site with EU and US visitors that wants EU personal data handled in the EU before anything reaches the US.
What the rule requires and whether it meets it
A visitor signature is a SHA-256 hash of the IP, user agent, site and a salt that rotates at midnight. EU visitors’ IPs are hashed on EU servers run by an EU company; the anonymised statistics are stored on its US infrastructure. Its DPA is signed and sent back.
Check with the vendor
Its own ePrivacy guide says cookie-free design is “not a universal exemption from consent”. Its DPA does not mention selling, sharing or advertising: ask for service-provider terms if the CCPA applies to you.
Simple Analytics
What it is
A hosted analytics service built to collect the least: no cookies, no IP addresses, not even hashed ones.
Who it fits
A site that wants page counts and referrers and is happy to give up returning-visitor tracking for it.
What the rule requires and whether it meets it
It counts a visit as unique from the referrer, not from any identifier, and drops the IP from every request. Data stays in the Netherlands. Its docs say it is not a processor under the GDPR, so it offers no DPA, and that it does not sell your data or use it for marketing or retargeting.
Check with the vendor
No DPA means no contract terms to point to under the CCPA either. If your procurement needs a signed agreement, ask about the custom agreement its FAQ mentions. Its optional AI chat sends aggregated stats to OpenAI after you agree.
Matomo
What it is
Full analytics in the mould of Google Analytics, as Matomo Cloud or On-Premise on your own server.
Who it fits
A team that needs GA-level reports, or wants the data never to leave its own infrastructure.
What the rule requires and whether it meets it
Out of the box it sets first-party cookies, including a 13-month visitor ID; one line of tracking code turns them off. IPs are masked by two bytes by default. Cloud runs in Frankfurt with backups in Dublin, and its DPA bars selling, sharing and ad targeting.
Check with the vendor
Matomo says that, on its own self-assessment, a CNIL configuration mode meets the criteria France’s regulator published on 4 July 2025 for consent-free audience measurement. That is a French exemption; confirm the settings yourself, and check other countries’ rules.
Pirsch
What it is
A hosted, cookie-free analytics service made and hosted in Germany, with an open-source core.
Who it fits
An EU business that wants German hosting and a DPA built on the EU’s standard clauses.
What the rule requires and whether it meets it
It hashes the IP, user agent, date and a per-site salt into a visitor ID, so a visitor cannot be recognised for more than 24 hours or across sites. The IP is not stored, fully or partly. Its DPA limits processing to your documented instructions.
Check with the vendor
The pages we read do not mention selling, sharing or advertising, or whether the whole service can be self-hosted. Ask before you rely on either.
Umami
What it is
Open-source web and product analytics, self-hosted or as Umami Cloud with a US or EU region.
Who it fits
A product team that wants funnels and events without cookies, on its own server or in the EU cloud region.
What the rule requires and whether it meets it
Its tracker sets no cookies, and IPs are not stored in analytics records. Its DPA has US service-provider terms: no selling, and no sharing for cross-context behavioural advertising.
Check with the vendor
The pages we read do not say how long its visitor identifier lasts. Its homepage also lists session replay and heatmaps: treat those as separate features and check them before you drop a banner.
How we compared them
We started from the hosted analytics tools a small site most often shortlists to replace GA4 without a banner, plus Matomo, the long-standing self-hosted option, and Umami, an open-source one with a cloud plan. GA4 is in the table as the baseline, not as a pick. Product-analytics suites built around feature flags and experiments are a different purchase and are left out.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does Google Analytics 4 need a cookie banner?
For EU visitors, in practice yes. Its tags set the _ga cookie to tell users apart, which is storing information on the visitor’s device, and that needs consent unless it is strictly necessary for a service they asked for. Consent mode changes what the tags do after a choice, but Google says it does not provide a banner. Our guide is Google Analytics GDPR compliant? covers what EU regulators have said about the transfer side.
If my analytics uses no cookies, can I remove the banner?
Only if nothing else on the site needs one, and only if the tool passes the device test where your visitors are. The EU data protection board says tracking built on the IP address can fall under the same rule as cookies (Guidelines 2/2023, ¶ 54–55), while an exemption may still apply. Several vendors here say no banner is needed; that is their reading, not a regulator’s ruling.
When is analytics data “sharing” under the CCPA?
“Sharing” is disclosing a consumer’s personal information to a third party for cross-context behavioural advertising, with or without payment (§ 1798.140(ah)). An analytics vendor bound by a written contract that bars it from selling or sharing is a service provider, not a third party. One that uses your visitors’ data to target ads on other sites puts you in sharing territory.
Is a hashed IP address still personal data?
It can be. The GDPR counts an online identifier as personal data when it can identify someone (Art. 4(1)). Fathom’s own compliance page says hashing “is not by itself a legal guarantee of anonymity”, and Matomo’s says masked IPs are “often still personal data”. A daily salt that is deleted makes the hash much harder to link back; it does not end the analysis.
Does EU hosting matter if the tool collects no personal data?
The GDPR’s transfer rules in Chapter V apply to personal data. But every tool here receives the visitor’s IP address with the request, even the ones that drop or hash it at once, so where that first step happens is worth knowing. The “Keeps the analytics data in the EU” row and each vendor’s card say where it happens.