GDPR-Compliant Analytics: Tools, Prices, Consent

GDPR-compliant analytics means measuring your website without processing visitors’ personal data unlawfully and without accessing their devices before they consent. Standard Google Analytics 4 can be used in the EU, but only behind prior opt-in consent, because it stores a _ga cookie that Google documents as “used to distinguish users” with a two-year default lifetime. Cookieless, EU-hosted tools such as Plausible (from $9 a month), Simple Analytics (from €20) and Matomo Cloud (from €22 excl. tax) store nothing on the device and are built to run without an analytics consent banner, although whether you can skip consent entirely still depends on your country’s rules.

The sections below cover what European regulators decided about Google Analytics, where it stands under the EU-US Data Privacy Framework, what the law says about cookieless tools, and how eight tools compare. We are an engineering studio, and nothing here is legal advice, so involve your DPO or counsel where you have real legal exposure.

In short

• GA4 needs prior consent in the EU: it stores identifiers on the visitor’s device, which Article 5(3) of the ePrivacy Directive only allows with consent unless the storage is strictly necessary.
• In 2022 the Austrian, French and Italian regulators found that specific websites’ use of Google Analytics unlawfully transferred personal data to the US. Since July 2023 those transfers can rely on the EU-US Data Privacy Framework, which the EU General Court upheld in September 2025. An appeal is pending.
• Cookieless does not automatically mean consent-free. The EDPB says JavaScript that makes a browser send data falls under Article 5(3), so the question becomes whether a national exemption for audience measurement applies.
• Entry prices seen on 23 October 2026: Pirsch $6, Plausible $9, Fathom $15, Simple Analytics €20, Umami Cloud $20 (with a free tier), Matomo Cloud €22 and Piwik PRO €36 a month.

Is Google Analytics compliant with GDPR?

Not by default. Two separate questions are involved: consent for touching the visitor’s device, and the transfer of data to the United States. The transfer has a legal basis for now; the consent requirement is unchanged.

What the regulators decided in 2022

After the Court of Justice invalidated Privacy Shield in Schrems II (July 2020), the privacy group noyb filed complaints about Google Analytics on European websites across the EU. Four outcomes matter:

• Austria: in a partial decision (case D155.027), the Austrian DSB found that an Austrian website operator, by implementing Google Analytics, had transferred the complainant’s personal data to Google LLC at least on 14 August 2020. That data was at least unique user identification numbers, the IP address and browser parameters. The standard contractual clauses and the additional measures did not give adequate protection, because Google is subject to US surveillance law (FISA 702). The complaint against Google LLC itself was rejected: the transfer rules bound the website operator as the exporter.
• France: on 10 February 2022 the CNIL put a website operator on formal notice over its use of Google Analytics. Its 2022 annual report says the CNIL ordered several organisations to stop using the tool.
• Italy: in a decision of 9 June 2022, announced on 23 June 2022, the Garante reprimanded Caffeina Media, the operator of a magazine website, for transferring users’ data to the US through Google Analytics without adequate safeguards. It gave the company 90 days to bring the transfers into line and urged every Italian website operator to check their own use of such tools.
• Denmark: Datatilsynet reviewed Google Analytics and the settings Google offers after these decisions. Its 2022 annual report says it concluded the tool cannot be used lawfully as it is: lawful use requires supplementary measures beyond Google’s own settings.

Each decision concerned a specific website and the tool as configured at the time. None of them banned Google Analytics across the EU, but together they made the tool hard to defend as it came out of the box.

Where Google Analytics stands since the Data Privacy Framework

On 10 July 2023 the European Commission adopted Implementing Decision (EU) 2023/1795. It says the US ensures an adequate level of protection for personal data transferred to organisations on the Data Privacy Framework List. Google LLC is on that list with an active EU-U.S. certification. That gives transfers to Google a legal basis that the 2022 decisions did not have.

The framework has survived its first court test. On 3 September 2025 the General Court dismissed the action brought by Philippe Latombe against the adequacy decision (case T-553/23). He has appealed, and the appeal, case C-703/25 P, was listed as pending when we checked on 23 October 2026. Its two predecessors, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice, so building your measurement on the framework is still a bet that it survives.

The framework only covers the transfer. In July 2023 Denmark’s Datatilsynet said it had not taken a position on whether Google Analytics is lawful, and stressed that the GDPR’s other requirements still apply, including the legal basis and the processor agreement. Cookie consent is a separate rule.

Do I need consent for Google Analytics?

Yes, for visitors in the EU. Article 5(3) of the ePrivacy Directive allows “the storing of information, or the gaining of access to information already stored” on a user’s device only with consent. The exception is storage or access that is strictly necessary to provide a service the user explicitly requested. Each member state has written this into national law; in Germany it is § 25 TDDDG. Analytics is not strictly necessary to show someone a web page, and GA4 stores _ga cookies on the device, so it needs consent before it runs.

Google says that in GA4 “IP addresses are not logged or stored” (Google’s help page), which reduces one of the issues the regulators raised but does not change the cookie question. And Google’s consent mode comes in two forms. In basic mode, Google tags do not load until the visitor interacts with the banner, and nothing is sent if they decline. In advanced mode, the tags load straight away and, while consent is denied, “send measurements without cookies”, which Google uses for modelling. Under the EDPB’s reading of Article 5(3), described in the next section, making the browser send those measurements may itself need a legal basis, so check advanced mode with your counsel before you rely on it.

In practice, analytics behind a consent banner only measures visitors who accept. You maintain a consent platform and a banner, and any modelled figures are estimates. We cover the effect of banners on page speed and search in how consent banners affect SEO.

Does cookieless analytics need consent?

Not always, but “cookieless” is not a legal category, and the answer depends on how the tool works and where you are.

The European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on 7 October 2024, read the rule broadly. They say that JavaScript code that instructs the browser to send information “clearly falls within the scope of Article 5(3)” (paragraph 33). They add that collecting the IP address can fall under it too, unless you can show the address does not come from the user’s device (paragraph 55). Most cookieless tools work exactly this way: a script sends a request with the page, referrer and browser details, and the server counts it.

The guidelines do not settle whether consent is needed. They say that falling under Article 5(3) “does not systematically mean that consent needs to be collected” (paragraph 56), and that the exemptions should be assessed case by case under national law and national regulators’ guidance. That is where countries differ:

• France has the clearest exemption. The CNIL’s rules for audience measurement allow trackers without consent if they are used strictly for measuring the site’s audience, produce anonymous statistics only, are not combined with other processing and do not track the person’s browsing across sites. The CNIL recommends a tracker lifetime of 13 months and keeping the data for at most 25 months. Its English guidance sheet adds that the last byte of the IP address should be truncated, and notes that most large audience-measurement offerings fall outside the exemption.
• Germany is less clear. Matomo’s own guidance on running without consent says that only server-side tracking methods are clearly recognised as not accessing the visitor’s device under the TDDDG, and it recommends treating JavaScript tracking as needing consent.

The rules may change. In November 2025 the Commission proposed a “Digital Omnibus” that would move the cookie consent rules from the ePrivacy Directive into the GDPR and widen the list of processing that is exempt from consent. The European Parliament’s Legislative Train (updated 20 September 2026) lists the file as “Tabled”, with work in the Council continuing. Until it is adopted, the current rules apply.

So a cookieless tool that identifies nobody and keeps the data in the EU is the lowest-risk way to measure traffic, and in some countries, France explicitly, it can run without consent if it is configured within the exemption. When a vendor says its tool needs “no cookie banner”, that is the vendor’s legal position, not a regulator’s ruling.

What GDPR-compliant analytics actually requires

Five requirements apply:

1. No device storage or access without consent, unless an exemption applies (ePrivacy Directive, Article 5(3)). This covers cookies, local storage and, in the EDPB’s view, scripts that make the browser send data.
2. A lawful basis for any personal data you process. Data that is truly anonymous falls outside the GDPR (recital 26). Identifiers, IP addresses and device data usually do not, and then you need a basis under Article 6. Legitimate interest is not a safe default here: in 2022 Datatilsynet found that a Danish classifieds site’s statistics processing with Google Analytics, which the site had based on its legitimate interests, did not comply with the GDPR.
3. Data minimisation (Article 5(1)(c)). Collect page views, referrers and aggregate device data, and only what you will use. Discard or truncate IP addresses at collection.
4. A known data location and a processor agreement. If a US provider processes the data, you rely on the Data Privacy Framework or standard contractual clauses. EU-hosted or self-hosted analytics removes the transfer question; we make the same argument for hosting in EU hosting vs US cloud.
5. Transparency (Article 13). Your privacy notice must describe what you run, what it collects and where the data goes.

GDPR-compliant analytics tools compared

All prices are from each vendor’s own pricing page, seen on 23 October 2026, for the cheapest paid plan with monthly billing. “Cookies” is what the vendor itself states.

Tool	Entry price	Traffic included	Cookies	Where data is processed
Google Analytics 4	Free	—	_ga cookies with a 2-year lifetime; consent needed	Google; EU-US transfers rely on the DPF
Pirsch	$6/mo (Standard), excl. VAT	10,000 page views, 50 sites	Cookieless (hash of IP, user agent and other data)	Germany
Plausible	$9/mo (Starter); sales tax added at checkout	10,000 page views, 1 site	No cookies or persistent identifiers	EU, on European-owned infrastructure
Fathom	$15/mo; tax not stated	100,000 page views, 50 sites	No analytics cookies	EU traffic anonymised in the EU, then processed in the US
Simple Analytics	€20/mo, 1 user; VAT not stated; free plan	100,000 page views	No cookies, no personal data	Netherlands
Umami Cloud	$20/mo (Pro); tax not stated; free plan	1 million events, 20 sites	No cookies	Servers in the US and the EU
Matomo Cloud	€22/mo (Business), excl. tax; currency varies by location	50,000 hits, 30 sites	Uses cookies unless you disable them	Frankfurt, Germany
Piwik PRO	From €36/mo (Business); VAT not stated	25,000 actions, 1 domain	Consent-based suite; anonymous tracking for visitors who decline	Sweden

Notes from each vendor’s own documentation:

• GA4 is the most capable free tool, and if your business runs on Google Ads, its integration is hard to replace.
• Matomo is the closest to GA4 in depth: funnels, heatmaps and session recordings, with a Google Analytics importer. It is run by InnoCraft Limited, a New Zealand company, and the cloud version is hosted in Frankfurt. It sets cookies by default, so the consent-free setup takes configuration. Its pricing page sets the currency by the visitor’s location: on 23 October 2026 it showed €22 on one load and SEK 199 from Denmark on others, so check the price in your own currency. You can also self-host the On-Premise edition, where the Community tier is free and the paid Team bundle costs €275 a month, or the equivalent of €230 a month with annual billing.
• Plausible is deliberately simple: traffic, goals, custom events and a Google Analytics import on every plan, with funnels on the $19 Business plan. Its legal entity is incorporated in Estonia, and it counts unique visitors with a hash that uses a salt deleted every 24 hours. Its code is open source. It says its script is 54 times smaller than Google Analytics’.
• Fathom is run by Conva Ventures Inc. under the law of British Columbia, Canada. Its “EU isolation” routes EU traffic separately and anonymises it in the EU before it goes to the US, so the data does not stay in the EU.
• Simple Analytics stores data in the Netherlands, where its operator is based. Extra users cost €20 a month each.
• Pirsch is run by Emvi Software GmbH and hosted in Germany. Prices are shown in dollars, but you can choose euros at billing.
• Umami is run by Umami Software, Inc. Its cloud servers are in the US and the EU, and the open-source version can be self-hosted for free.
• Piwik PRO assumes you collect consent: its Business plan bundles a consent management platform, and the company adjusts prices by 4% a year.

What is a good free alternative to Google Analytics?

If you want to pay nothing, there are two routes:

• A free cloud plan. Umami Cloud’s Hobby plan covers 100,000 events a month for one website, with six months of data. Simple Analytics has a free plan for up to five websites, but it keeps only the latest month of data and requires a badge on your site.
• Self-hosting. Matomo On-Premise (Community), Umami and Plausible all publish code you can run on your own server. The licence is free; the server, updates and backups are your cost and your responsibility.

For a business site, the free cloud plans are mostly useful for testing. Data retention of one to six months is too short to compare a season with the same season last year.

How to switch from GA4 without losing your history

1. Export or import what matters. Plausible, Matomo and Pirsch all list a Google Analytics import on their pricing pages. Otherwise, export monthly aggregates (sessions, top pages, referrers, conversions) to a spreadsheet so you keep a reference.
2. Run both tools side by side for a month or two. The numbers will not match, because the two tools count differently and only one of them depends on consent. Set your new baseline before you make decisions from it.
3. Recreate goals and UTM conventions in the new tool.
4. Remove GA4 and update your privacy notice. If analytics was the only reason for your banner, you may be able to drop it, depending on the national rules above. If other scripts that need consent remain (ads, embedded video), the banner stays but covers less.
5. Document the setup: tool, hosting location, retention period, and what is and is not collected. That document answers most of what a customer’s vendor questionnaire will ask.

Webshops have extra moving parts, such as payment providers and product feeds. We cover those in building a GDPR-ready webshop and the shorter GDPR checklist for online shops.

Analytics and your SEO budget

If you pay for SEO, analytics is how you check whether it works: organic visits, landing pages and conversions over months. When you are budgeting for SEO, ask your provider which tool sits behind the monthly report, whether it only counts visitors who accept a banner, and where the data is stored.

Our SEO plan costs €690/mo excl. VAT and includes a monthly ranking and traffic report, and Performance Ads (€990/mo + ad spend, excl. VAT) includes GDPR-compliant conversion tracking. You can compare the plans on our pricing page or read how our SEO service works.

The bottom line for EU businesses

For most European business websites, a cookieless, EU-hosted analytics tool is the simplest compliant setup. It raises the fewest legal questions and, where your country’s rules give a consent exemption, counts visitors whether or not they click a banner. Keep GA4 if you have a concrete, revenue-linked reason, usually a dependence on Google Ads, and accept the consent machinery that comes with it.