Privacy-friendly analytics: what it means and how to choose
Privacy-friendly analytics (also called privacy-first or privacy-focused) counts visits to your site without building a profile of each visitor. The usual marks are no cookies, no personal data kept, and a clear answer on where the data lives. There is no legal standard behind the label, so you judge a tool by what it stores and collects.
TL;DR
- Privacy-friendly analytics counts visits without following people. The usual marks are no cookies, no personal data kept, and data you can say where it lives.
- You give up some accuracy: without a lasting ID, one person can count as several visitors, and returning-visitor and journey reports go away.
- "No cookie banner needed" is a claim to check against your own country's rules, not a feature you switch on.
If you run more than one site and want visits, sources and sales on one screen, Stickybeak has a privacy mode that uses no cookies. It is in early access.
Get early accessWhat makes analytics privacy-friendly
Three questions separate the tools. Ask them of any analytics product, including ours.
- What does it store on the visitor's device? A cookie or other lasting ID lets a tool recognise the same person on their next visit. Without one, each page load looks like a new person.
- What does it collect and keep? Raw IP addresses, user agents, and anything personal that slips into a page address or an event are the main ones. A tool can be cookieless and still collect these.
- Where does the data live, and who can reach it? A vendor in the EU, a server you run yourself, or a US cloud each answer differently for a European visitor.
"Cookieless" answers only the first question. A tool that sets one first-party cookie but keeps very little can be more private than a cookieless tool that stores full IP addresses, so look at all three.
This is not legal advice. It describes what each vendor says on its own pages, checked on 23 October 2026. Rules differ by country and change, so check your own data protection authority or ask a lawyer. Stickybeak makes no claim that any setup is compliant.
Do privacy-friendly tools need a cookie banner?
Sometimes not, but it is not a switch a vendor can flip for you. The ePrivacy rules in Europe cover reading or storing information on a visitor's device, which is wider than cookies, and the GDPR covers personal data on top. Regulators draw the line differently.
The French regulator, CNIL, lists conditions under which audience measurement is exempt from consent: people are informed and can object, the data is used only for audience measurement, it is not cross-checked with other processing, the tracker is limited to one site's publisher, the last byte of the IP address is truncated, and the tracker lasts no longer than 13 months. It also says most large audience measurement offerings do not fall within the exemption, whatever their configuration. See CNIL's guidance on analytics.
Vendors state their own position, and you should read it as theirs. Plausible says "you do not need cookie banners for analytics or to collect consent for tracking". Fathom says it "doesn't use cookies, so no consent banner is required for your analytics". Umami says that GDPR compliance "depends on how you configure and use it". Whether those statements hold for your site depends on your visitors' countries and your setup. For what Google Analytics sets by comparison, see Is Google Analytics GDPR compliant?
How the main privacy-first tools describe themselves
Quotes are from each vendor's own pages. Where a page did not say, the cell says so; that is not the same as the product lacking it.
| Tool | Cookies | Personal data | Data location and hosting | Consent, in the vendor's words |
|---|---|---|---|---|
| Plausible | "We do not use cookies, browser cache or local storage." | "Raw IP addresses and User-Agent data are never stored." | All visitor data "processed and stored in the EU on infrastructure owned by European companies." | "You do not need cookie banners for analytics or to collect consent for tracking." |
| Fathom | "Fathom doesn't use cookies." | "Anonymous pageview tracking that doesn't collect or store personal data." | "Your EU traffic is automatically routed through European-owned infrastructure." | "No consent banner is required for your analytics." Also says it is GDPR, CCPA, ePrivacy and PECR compliant. |
| Simple Analytics | Describes itself as analytics "without analytics cookies". | Says metadata "must not contain personal data". | Describes itself as EU-hosted, "a simple, privacy-friendly European Google Analytics alternative". | "Consent requirements depend on the implementation and applicable rules." |
| Umami | "Umami's web tracker does not use cookies." | Collects pageviews, referrer URLs, browsers, operating systems, device types and approximate location. | Open source; can be self-hosted on your own infrastructure. | "GDPR compliance depends on how you configure and use it." |
| Matomo | Can track without cookies, but says that without them it identifies visitors by IP address and other footprints, "but this will be inaccurate". | Not covered in the pages we read. | On-Premise: you host it. Cloud: Matomo hosts it, in Frankfurt, per its pricing page. | Says it is "exempt from tracking consent" in France. That depends on how you set it up. |
| Stickybeak | Standard script: three first-party cookies. Privacy mode: no cookies. | IP addresses are never stored. Privacy mode records location at country level only. | Built on Cloudflare. We do not state a data region on our site. | We make no compliance claim. See consent and cookie banners. |
Sources: Plausible data policy, Fathom, Simple Analytics, Umami FAQ, Matomo cookieless FAQ, Matomo pricing, and Stickybeak's privacy mode and data collected docs. For tool-by-tool prices and fit, see our Google Analytics alternatives guide and best website analytics tools; Matomo against Google is in Matomo vs Google Analytics.
What you give up
Privacy-friendly does not mean free of trade-offs. Mostly you give up certainty about individual people.
- Unique visitors get fuzzier. With no lasting ID, a tool either guesses from IP address and device details or counts each page load as a person. Matomo notes that cookieless unique-visitor counts are inaccurate. See why visitor numbers never match.
- Returning visitors disappear. Matomo says that without cookies all visits are counted as new, which makes reports such as days since last visit and visits by visit count inaccurate.
- Attribution gets shorter. If someone clicks a newsletter link on Monday and buys on Thursday, a tool with no memory cannot connect the two. Same-visit conversions still work. Tidy UTM parameters matter more, not less.
- Less detail, on purpose. Country instead of city, no user-level histories, shorter retention.
What you keep: pageviews, top pages, referrers, campaigns, countries and devices. For most small sites that answers the questions that matter. It is also why metrics like bounce rate and session length need a second look when you switch, because they depend on how visits are stitched together.
How to choose
- Start from your visitors. If they are mostly in the EU or UK, the consent question is real for you. If they are elsewhere, it may weigh less.
- Decide who hosts. Self-hosting (Umami, Matomo On-Premise) gives you control and a server to maintain. A hosted tool gives you a bill and a vendor's promise about where data sits.
- List the reports you use. If you need returning visitors, long customer journeys or revenue by campaign, check what the tool can do without a lasting ID before you commit.
- Read the vendor's data page, not the home page. The claims above all come from them. Look for what is stored, what is collected, how long it is kept, and where.
- Test it on one site for a few weeks next to your current tool. Expect the visitor counts to differ, because the counting method changed.
How Stickybeak handles privacy
Stickybeak is live analytics for people who run more than one site: every site on one wall, with revenue tied to the channel it came from. It has two modes, and you choose per site.
- Standard sets three first-party cookies (a visitor, a session and a session count). There are no third-party cookies and no fingerprinting, and IP addresses are never stored.
- Privacy mode uses no cookies at all. Visitor and session IDs live in the page's memory only, location is country only, goal properties are dropped, revenue amounts are not recorded and raw data is deleted after 32 days, leaving daily totals. The full table of what changes is in the privacy mode docs.
What you give up in privacy mode is what the section above describes: every page load is a new visitor, there are no returning-visitor numbers or order trails, and no revenue reporting. Pageviews, referrers, campaigns, countries, devices and goal counts still work. You can also load the standard script only after consent, as set out in consent and cookie banners.
Stickybeak is in early access, and we do not claim that either mode makes a site compliant. See pricing for plans, including a free plan for small sites.
Questions
What is privacy-friendly analytics?
Privacy-friendly analytics (also called privacy-first or privacy-focused analytics) counts visits to a website without building a profile of each visitor. The tools that use the label usually avoid cookies, keep no personal data, and say where the data is stored. The label is not a legal standard, so what each tool does has to be read from its own documentation.
Is cookieless analytics the same as privacy-friendly analytics?
No. Cookieless means the tool does not store cookies in the browser. A cookieless tool can still collect personal data, and a tool that sets a first-party cookie can still keep very little. Look at both what is stored on the device and what is collected.
Do I still need a cookie banner with privacy-friendly analytics?
It depends on the tool's settings and on your country. Some vendors say you do not need a banner for analytics. The French regulator, CNIL, lists conditions for audience measurement to be exempt from consent and says most large offerings do not fall within the exemption regardless of configuration. Check your own regulator or ask a lawyer; this is not legal advice.
Is privacy-friendly analytics GDPR compliant?
A tool cannot make you compliant on its own, because the GDPR applies to how you use it. Umami, for example, says that compliance depends on how you configure and use it. Using a tool that collects less personal data makes the questions easier, not unnecessary.
What do you lose with privacy-friendly analytics?
Mostly accuracy about people. Without a lasting identifier, one person on several pages can count as several visitors, returning visitors cannot be told from new ones, and multi-visit attribution weakens. Matomo says that with cookieless tracking all visits are counted as new visitors, which makes some reports inaccurate. Pageviews, top pages, referrers and countries still work.
Does Stickybeak have a privacy-friendly mode?
Yes. Stickybeak's privacy mode uses no cookies, keeps IDs only in page memory and records location at country level. It drops revenue amounts and returning-visitor data. The standard script sets three first-party cookies. Stickybeak is in early access, and nothing here is a claim of legal compliance.
Facts checked: 23 October 2026. Sources: Plausible, Data policy. Fathom, home page. Simple Analytics, home page. Umami, FAQ. Matomo, cookieless tracking FAQ and pricing. CNIL, analytics guidance. Stickybeak facts come from this site's privacy mode docs and home page. Vendors change their pages; if one has moved on, tell us and we will fix it.