PostHog vs Google Analytics
For a product team with EU users deciding between Google Analytics 4 and PostHog, or running both. The two measured on what the EU device rule, the GDPR and the California law ask of an analytics script, from each vendor’s own documentation, with Plausible and Fathom alongside as the lighter options. read 2026-10-22
Best for product analytics under GDPR
PostHog
EU Cloud in Frankfurt, IP capture off by default for new EU projects, a countersigned DPA on any plan, and a cookieless mode when you need one.
Best when Google ads pay the bills
Google Analytics 4
Conversions, audiences and analytics in one Google account beside your ads; for EU visitors it needs a banner in front of it.
Best for traffic counts with no device storage
Plausible
On its own pages: no cookies or local storage, a daily salt deleted every 24 hours, servers in Germany and a DPA that applies on use.
The requirements, product by product
Each row is something the EU device rule, the GDPR or the California law asks about, with the article or section cited under it. GA4 and PostHog come first; Plausible and Fathom are there to show what a web-only counter gives up and gains. Where a cell depends on a setting, the note names it.
| Requirement | Google Analytics 4 | PostHog | Plausible | Fathom |
|---|---|---|---|---|
| Stores nothing on the visitor’s device by defaultePrivacy Art. 5(3) | no_ga cookies | nocookie + localStorage, 365 days | yes | yesno tracking cookies |
| Has a set-up that stores nothing on the deviceePrivacy Art. 5(3) | partialadvanced consent mode, while denied | yescookieless mode “always” | yes | yes |
| Recognises a visitor for one day at mostGDPR Art. 4(1) (online identifier) | no_ga: 2 years | partialcookieless mode only (daily salt) | yesdaily salt | yesdaily salt |
| Does not store visitor IP addressesGDPR Art. 4(1); Art. 5(1)(c) | yesEU, Swiss and UK traffic | yesEU Cloud default; a toggle elsewhere | yes | yeshashed; EU traffic in the EU |
| Keeps the analytics data in the EUGDPR Art. 44 (transfers) | not statedcollected on EU servers | yesEU Cloud: Frankfurt | yesGermany | partialanonymised in the EU, stored in the US |
| Names a transfer tool for data that leaves the EUGDPR Art. 45(1); Art. 46(2)(c) | yesData Privacy Framework and SCCs | yesData Privacy Framework and SCCs | not statedsays data stays in the EU | not statedhashes EU IPs in the EU first |
| Offers a data processing agreementGDPR Art. 28(3) | yesaccept it in the account outside the EEA, UK, CH | yesself-serve, countersigned, any plan | yesaccepted by use | yessign and return |
| Contract bars the vendor from selling or sharing the dataCal. Civ. Code § 1798.140(ag)(1)(A) | partialunder restricted data processing | yes | yes | not statedin its DPA |
| Keeps the data out of ad targeting§ 1798.140(ah)(1) and (k) | partialdepends on Google signals and ad links | yes | yes | not stated |
| Can run on your own serverno outside processor (Art. 28) | no | yesMIT, unsupported, free features only | yesCommunity Edition | not stated |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||||
The two headline products differ on most rows, and the gaps come down to three things. PostHog has a set-up with nothing on the device at all, where GA4 goes cookieless only while consent is denied. PostHog can run on your own server; GA4 runs on Google’s. And PostHog’s contract bars selling and sharing on every plan, where Google’s does so under restricted data processing. Both name the same transfer tools for data that leaves the EU.
The banner depends on the set-up, not the brand
Both products can run with a banner or, in PostHog’s case, without one. What decides it is the set-up you choose on day one: what lands on the visitor’s device, and whether anything is sent before they answer. Google calls its two set-ups basic and advanced consent mode; PostHog has its default storage and two cookieless modes. Neither ships a banner: Google says consent mode “does not provide a consent banner or widget”, and PostHog leaves the opt-in call to your code.
| Set-up | Stored on the device | Before a choice | After a “no” | What you give up |
|---|---|---|---|---|
| GA4basic consent mode | _ga cookies, once the visitor accepts | Tags blocked; nothing reaches Google | Nothing sent, not even the consent state | Ads conversion modelling falls back to a general model |
| GA4advanced consent mode | _ga cookies, once the visitor accepts | Tags load with consent set to denied and send measurements without cookies | Cookieless pings; Google fills the gaps with modelling | Tags run and send data before any choice is made |
| PostHogdefault | A first-party cookie kept 365 days, plus localStorage | Captures at once, unless opt_out_capturing_by_default is on | Stops when your banner calls opt_out_capturing() | Nothing in the product; its GDPR guide says cookies for logged-out visitors call for a banner |
| PostHogcookieless “on_reject” | Nothing until the visitor opts in | No events until consent is given or denied | Counted with a daily-salted hash made on PostHog’s servers | Session replay and surveys stay off for visitors who refuse |
| PostHogcookieless “always” | Nothing, ever | No banner: every visit is counted by the daily hash | There is no choice to record | No replay, surveys, GeoIP or bot detection; weekly and monthly uniques run high |
Source: Google’s consent mode documentation and PostHog’s persistence and cookieless guides, read 2026-10-22. | ||||
Only one row stores nothing and asks nothing: PostHog in “always” mode. That is close to how Plausible and Fathom work all the time, at the price of most of what makes PostHog worth installing. The “on_reject” mode is the middle road for a product team: full tracking for visitors who accept, a cookieless count of those who refuse, and a banner either way. To build that banner, start with the cookie banner checklist.
PostHog’s tutorial says its daily hash of team, IP address, user agent and host “is not considered Personal Data”. That is the vendor’s reading. The GDPR counts an online identifier as personal data when it can identify someone (Art. 4(1)), and the EU data protection board says tracking built on the IP address alone can fall under the device rule, with no cookie at all (Guidelines 2/2023, ¶ 54–55), though an exemption may still apply (¶ 56). Our two tests for a “no banner” claim walk through both. Information, not legal advice.
A product suite collects more, so set it to collect less
GA4 measures traffic and conversions. PostHog is a product suite: product analytics, session replay, feature flags, experiments, surveys and more on one script. Each extra part is more personal data, and the GDPR asks for only what each purpose needs, by default rather than on request (Arts. 5(1)(c) and 25(2)). These are the parts to set before the script goes live.
- autocapture
- By defaultOn in the JavaScript web SDK: clicks on links, buttons, forms and inputs, form submissions and changes, and copies from the clipboard. Form values are not captured automatically.
- What to setAdd the ph-no-capture class to anything a visitor should not be recorded touching, or narrow autocapture in the init call.
- session replay
- By defaultEvery input field is masked. General text on the page is not.
- What to setMask text too on any screen that shows account, health or payment details, and test a recording before launch.
- IP data capture
- By defaultOff for new projects on PostHog Cloud EU; on for US Cloud and self-hosted until you change it.
- What to setTurn on “Discard client IP data” per project. Location and bot filtering can still read the IP before it is dropped.
- identify()
- By defaultLinks events to a known person. In cookieless mode PostHog says a persistent ID undoes the privacy benefit.
- What to setIn “always” mode set person_profiles: 'never', which makes identify calls do nothing.
- transformations
- By defaultNone on your data until you add them.
- What to setHash or drop personal fields before storage. PostHog recommends anonymising EU visitors’ data on US Cloud or on a server outside the EU.
- AI features
- By defaultIts DPA says, once enabled, they may rely on OpenAI’s model or similar LLMs, with extra subprocessors listed for them.
- What to setDecide before anyone turns them on, and add the AI subprocessors to your records. Our GDPR and AI tools guide covers the checks.
GA4’s nearest switch is Google signals. When you activate it, reports are enriched for users signed in to Google with ads personalisation on, and you can turn collection on or off region by region. It is also what the ad-targeting row in the table depends on, together with links to Google’s ad products.
Read the vendor’s guide against the text
Both vendors publish compliance guides, and a product team often treats them as the checklist. Four lines in PostHog’s guides, read on the day of this comparison, carry figures or claims that differ from the text they describe; Google’s terms hide two switches that stay off until someone acts. None of this makes either product worse at its job. It changes what you write in your own policies.
The vendor’s page says
“Have a gross annual revenue of over $25 million” or “Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices”
The text says (Cal. Civ. Code § 1798.140(d)(1))
Revenue over $26,625,000 (CPI-adjusted, effective 1 January 2025); buys, sells or shares the personal information of 100,000 or more consumers or households; or 50 percent or more of revenue from selling or sharing.
What to do: Test your own figures in the CCPA threshold calculator, not the guide’s.
The vendor’s page says
“Children under 13 can only give consent with permission from their parent”
The text says (GDPR Art. 8(1))
Consent is lawful on its own from age 16; each Member State may lower that, to no less than 13.
What to do: If children use your product, check the age set in each country you serve before you rely on in-app consent.
The vendor’s page says
“If you have a data breach, you have 72 hours to tell the data subjects or face penalties.”
The text says (GDPR Arts. 33(1), 34(1))
The supervisory authority is told without undue delay and, where feasible, within 72 hours. The people affected are told without undue delay when the breach is likely to result in a high risk to them.
What to do: Write the 72-hour clock into your breach plan as the regulator’s clock, and the high-risk test as the trigger for telling people.
The vendor’s page says
EU Cloud servers in Frankfurt, “ensuring user data never leaves EU jurisdiction”
The text says (PostHog DPA § 10.2; GDPR Arts. 44–46)
The DPA you sign says PostHog “will Process the Company Personal Data outside of the Protected Area including in the US and elsewhere as identified on the Subprocessor Page”, and covers that with the Data Privacy Framework and standard contractual clauses.
What to do: Read the subprocessor list for your region and name the transfer in your records; the data map template has a column for it.
Google, Analytics data processing terms
The vendor’s page says
Customers established outside the EEA, the UK or Switzerland “need to proactively accept such terms in their Account Settings”
The text says (GDPR Art. 28(3); § 1798.140(ag)(1))
A processor contract has to be in place before the processing (Art. 28(3)). Under the California law, Google acts as a service provider that “will not sell or share” only for data processed under restricted data processing, a setting you enable.
What to do: A US company with EU visitors: accept the terms under Account Settings. If the California law applies, switch on restricted data processing to hold Google to service-provider terms.
Each product in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. Keeping GA4, or PostHog with cookies, means a consent banner: our consent management platforms page compares those.
Google Analytics 4
What it is
Google’s free web and app analytics, built around traffic sources, conversions and the link to Google’s ad products.
Who it fits
A marketing team that already runs a consent banner and spends on Google Ads, so conversions, audiences and reporting belong in one Google account.
What the rule requires and whether it meets it
Users are told apart by the _ga cookie, which lasts two years unless you change it; for EU visitors that means the tag waits for consent. For EU, Swiss and UK traffic, Google says IP addresses are neither logged nor stored. US transfers rest, Google says, on the Data Privacy Framework in certain circumstances, with standard contractual clauses in its processing terms. Under the CCPA, Google is a service provider only for data handled under restricted data processing.
Check with the vendor
The pages we read leave open where Analytics data is kept after the EU collection servers pass it on. Consent mode is only a signal: it reads a banner you supply, and Google says it does not provide one.
PostHog
What it is
An open-source product suite: product analytics, session replay, feature flags, experiments and surveys on one script, as PostHog Cloud (US or EU region) or self-hosted.
Who it fits
A product team that wants to see what signed-in users do inside the app, test features on them, and keep the data in Frankfurt.
What the rule requires and whether it meets it
By default it keeps a first-party cookie for 365 days plus localStorage, so in the EU that set-up needs consent; a cookieless mode drops all device storage and counts visitors with a daily-salted hash. New EU Cloud projects discard IP addresses by default. Its DPA is self-serve and countersigned on any plan, bars selling and sharing, and names itself a service provider.
Check with the vendor
Its DPA allows processing in the US and elsewhere on its subprocessor list, even for EU Cloud: read the list for your region. Self-hosting is free under MIT but unsupported, with paid features Cloud-only. Its CCPA guide quotes older thresholds; see the section above.
Plausible
What it is
Open-source web analytics from an EU company: a hosted service, or the free Community Edition you run yourself under the AGPL.
Who it fits
A marketing site that needs page views and traffic sources on one page, not product analytics, and wants no banner question for them.
What the rule requires and whether it meets it
Nothing is written to the device: no cookie, no local storage, no browser cache. A visitor is counted from a hash of the IP address, user agent and site domain plus a salt deleted every 24 hours, and the raw IP is never kept. The servers are in Germany. The DPA takes effect when you use the service, needs no signature, and states that your data is not sold.
Check with the vendor
Plausible’s policy tells you its analytics needs no banner. Treat that as the vendor’s view: the device test on our alternatives page shows where regulators read it differently.
Fathom
What it is
Cookie-free hosted analytics that sends EU traffic down its own route, a set-up Fathom names EU isolation.
Who it fits
A site with visitors on both sides of the Atlantic that wants EU visitors’ personal data processed inside the EU before any of it travels to the US.
What the rule requires and whether it meets it
Each visitor becomes a SHA-256 signature built from the IP, user agent, site and a salt that rotates at midnight. For EU visitors that hashing runs on EU servers operated by an EU company; only the anonymised statistics go on to its US infrastructure. Its DPA is a sign-and-return document.
Check with the vendor
Fathom’s compliance page itself warns that hashing “is not by itself a legal guarantee of anonymity”. The DPA is silent on selling, sharing and advertising, so if the CCPA reaches you, ask for service-provider terms.
How we compared them
This is a head-to-head of the two names in the search: a product team on GA4 asking what PostHog would change, and the reverse. Plausible and Fathom are included because the same searchers compare them, and because they show where the device-storage rows land for a web-only counter. Other cookieless tools are measured on our Google Analytics alternatives page, on the same rows.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does PostHog need a cookie banner?
In its default set-up, for EU visitors, in practice yes: it stores a cookie and localStorage on the device, and that needs consent unless it is strictly necessary for a service the visitor asked for. PostHog’s own GDPR guide says a site using its cookies for logged-out users should run a banner. Its cookieless “always” mode stores nothing on the device, which removes the cookie question but not the question of the IP address used to build its daily hash.
Does PostHog Cloud EU keep all the data in the EU?
The stored data sits on servers in Frankfurt. Its DPA still allows processing outside the EU, “including in the US”, by the subprocessors it lists, and covers those transfers with the Data Privacy Framework and standard contractual clauses, two of the routes the GDPR’s transfer rules allow (Arts. 44–46). Your notice and records should say so. For the regulators’ history with Google Analytics transfers, read is Google Analytics GDPR compliant?
Do I need a data processing agreement with either one?
If either vendor processes personal data for you, the GDPR requires a processor contract (Art. 28(3)). PostHog Cloud customers generate one, already countersigned, on any plan. Google’s terms are built in for businesses established in the EEA, UK or Switzerland; others accept them in Account Settings. Self-hosted PostHog has no outside processor, so the processor question moves to whoever hosts your server. Our data processing agreement template lists the clauses.
Is analytics data “sharing” under the CCPA?
“Sharing” is disclosing personal information to a third party for cross-context behavioural advertising, paid or not (§ 1798.140(ah)). A vendor bound by a written contract that bars selling and sharing is a service provider, not a third party. PostHog’s DPA carries that bar on every plan; Google’s applies under restricted data processing. If ad pixels sit beside your analytics, our guide to the “Do Not Sell or Share” link covers what they change.
Can I run GA4 and PostHog side by side?
You can, for example GA4 for acquisition and ads and PostHog inside the app. The rules then apply to each. For EU visitors the banner has to cover GA4’s cookies, the privacy notice names both, and both sit in your record of processing with their transfers. Set PostHog’s consent calls from the same banner so one “no” stops both.