Cookieless, GDPR-Compliant Analytics for EU Businesses

Yes, you can run useful website analytics in the EU without cookies and without a consent banner, if the tool collects no personal data and sets nothing on the visitor’s device. Cookieless, EU-hosted tools like Plausible, Umami, and Matomo (in its cookieless configuration) are built for exactly this. What you cannot do is run standard Google Analytics 4 and skip consent: GA4 sets identifiers on the device and processes personal data, so under the ePrivacy rules and the GDPR it requires prior opt-in consent, and a large share of your traffic will decline or ignore the banner, leaving you with partial data anyway.

That is the short answer. The longer answer, which this article covers, is why GA4 became a legal and practical liability for EU businesses, what the law actually requires, and how the cookieless alternatives compare. One note up front: we are an engineering studio, not a law firm. This is technical and practical guidance, not legal advice; for decisions with real legal exposure, involve your DPO or counsel.

Why Google Analytics Became a GDPR Problem in the EU

Two separate legal issues collided in Google Analytics, and it helps to keep them apart.

Issue one: cookies and device access. The ePrivacy Directive (implemented in every member state, e.g. Germany’s TTDSG/TDDDG) requires consent before storing or reading anything on a user’s device that is not strictly necessary to deliver the service the user requested. Analytics is not strictly necessary. GA4 stores client identifiers on the device, so consent is required before it runs. This is settled and largely undisputed; it is why the banners exist.

Issue two: data transfers to the US. Between 2020 and 2023, after the CJEU’s Schrems II judgment invalidated Privacy Shield, several EU supervisory authorities examined Google Analytics specifically. The Austrian DSB (January 2022), the French CNIL (February 2022), and the Italian Garante (June 2022) each found that the Google Analytics implementations they reviewed unlawfully transferred personal data (including IP addresses and online identifiers) to the United States without adequate safeguards. Denmark’s Datatilsynet and others issued similar guidance. These decisions concerned the tool as then configured, but the practical message across the EU was “using Google Analytics as-is is hard to defend.”

In July 2023 the EU–US Data Privacy Framework (DPF) restored a legal transfer mechanism for certified US companies, Google included. That eased issue two for now, but three caveats matter. The DPF faces the same kind of legal challenge that killed its two predecessors, so building your measurement stack on it is a bet on its survival. The pre-DPF DPA rulings were never about a missing framework alone; they scrutinized whether identifiers plus metadata constitute personal data and whether supplementary measures actually work. And the DPF does nothing about issue one: consent for the cookies and identifiers is still required regardless of where the data ends up.

The practical problem on top of the legal one: consent-gated analytics measures only consenting visitors. Real-world opt-in rates for analytics commonly land somewhere between 30% and 70% depending on banner design and audience. Google’s answer, consent mode (v2), fills the gap with cookieless pings and modeled conversions, which is legitimate engineering but means part of your “data” is a statistical estimate, and consent mode’s advanced variant still sends signals before consent, which several EU regulators view skeptically. You end up maintaining a consent platform, a banner that hurts UX and conversion, and an analytics dataset that is partly modeled, all to keep a free tool.

What GDPR-Compliant Analytics Actually Requires

Stripped of vendor marketing, the requirements stack up like this:

1. No device storage/reading without consent, unless strictly necessary (ePrivacy). Truly cookieless tools that fingerprint-free count visits without storing identifiers on the device avoid this trigger. Note that consent requirements are not only about cookies; any device access counts, and some regulators treat certain fingerprinting techniques as equivalent to cookies.
2. A lawful basis for any personal data processed (GDPR). Aggregate, non-identifying statistics can often rest on legitimate interest; anything involving persistent identifiers, cross-site tracking, or advertising needs consent.
3. Data minimization. Collect page views, referrers, and aggregate device data; do not collect what you will not use. IP addresses should be discarded or truncated at ingestion.
4. Known data location and processors. If a US provider processes the data, you are relying on the DPF or SCCs plus supplementary measures. EU-hosted or self-hosted removes the transfer question entirely, which is the robust position; the reasoning mirrors our broader take in EU hosting vs US cloud.
5. Transparency. Whatever you run must be described accurately in your privacy notice.

A useful mental model: the fewer questions your analytics setup raises, the more compliant it tends to be. A tool that stores nothing on devices, identifies nobody, and keeps data in the EU raises almost none.

Cookieless Analytics Tools Compared: Matomo, Plausible, Umami, GA4

	GA4 + consent mode	Matomo	Plausible	Umami
Consent banner needed	Yes	No, in cookieless config (cookie mode: yes)	No, in standard config	No, in standard config
Data location	Google infrastructure; EU relies on DPF	Self-hosted anywhere, or Matomo Cloud (EU)	EU cloud, or self-hosted	Self-hosted, or cloud
Cost	Free (tool); real cost is CMP + engineering + risk	Free self-hosted (server ~€10–€50/mo) or cloud from ~€20/mo	From ~€9–€19/mo, or self-hosted CE	Free self-hosted; cloud free tier, paid from ~$20/mo
Depth of analysis	Very deep: funnels, audiences, BigQuery, Ads integration	Deep: funnels, heatmaps, e-commerce (some features paid)	Deliberately simple: traffic, goals, UTM, basic funnels	Simple: traffic, events, goals
Data completeness	Partial (consent-gated) + modeled	Near-complete in cookieless mode	Near-complete	Near-complete
Best fit	Heavy Google Ads spend, complex product analytics teams	Organizations wanting GA-like depth under full EU control	Most SMB marketing sites	Developers wanting free self-hosted simplicity

Fair notes on each. GA4 remains genuinely powerful, and if your business runs on Google Ads, its integration is hard to replace; the trade is legal complexity plus lossy data. Matomo is the most capable EU option and the only one approaching GA4’s depth, but self-hosting it is a real operational commitment (updates, scaling, backups), and in cookie-enabled mode it needs consent like anything else. Plausible is the pragmatic default for most small and mid-sized businesses: one lightweight script, EU-hosted, and its simplicity is a feature, not a gap, because most businesses use five reports. Umami is excellent when you have the engineering habit to self-host and want zero license cost.

There are other credible options in the same family (Fathom, Simple Analytics, Pirsch, all privacy-first, some EU-based); the four above cover the decision space.

What We Run, and What It Costs (First-Party Data)

At OneStopDigital we deploy cookieless, EU-hosted analytics as the default on every site we build, and analytics upkeep is included in our maintenance plans (€50/month Essential, €130/month Growth; full details at /pricing/). In practice that means most of our clients ship with no analytics consent banner at all, because nothing in the stack requires one. The measurable side effects, from our own projects rather than a vendor study: pages lose 50–90 KB of tracking JavaScript, there is no banner suppressing conversion on the first pageview, and reported traffic stops being an artifact of opt-in rates.

The honest limitation: cookieless analytics cannot do individual-level user journeys across sessions, remarketing audiences, or ad-platform conversion matching at GA4’s level. For a content site, a service business, or most webshops, that costs you nothing you actually use. For a business spending heavily on paid acquisition, the usual compromise is a hybrid: cookieless analytics as the always-on source of truth, plus consent-gated ad measurement only where the spend justifies the banner. Webshops have extra moving parts here (payment providers, product feeds); we cover that in GDPR-compliant webshop development.

How to Migrate Off GA4 Without Losing Your History

1. Export what matters. GA4 data cannot be imported elsewhere, so export monthly aggregates (sessions, top pages, referrers, conversions) to spreadsheets or BigQuery for reference.
2. Run both in parallel for one or two months. Expect the new tool to report more traffic than GA4, often 20–50% more, because it is not consent-gated; establish the new baseline before switching decisions over to it.
3. Recreate goals and UTM conventions in the new tool. This is usually an afternoon, not a project.
4. Remove GA4 and, if analytics was its only job, the consent banner. Update the privacy notice to describe the new tool. If other consent-requiring scripts remain (ads, embedded video), the banner stays but its scope shrinks.
5. Document the setup: tool, hosting location, retention period, what is and is not collected. This one page is most of what a customer’s vendor questionnaire will ask for.

The Bottom Line for EU Businesses

Cookieless, GDPR-compliant analytics is not a compromise product anymore. For the majority of European businesses it is simply the better engineering choice: legally quiet, faster pages, no banner tax on conversions, and data that reflects all visitors instead of the consenting subset. Keep GA4 only if you have a concrete, revenue-linked reason, usually deep Google Ads dependence, and accept the consent machinery that comes with it.

Analytics is also where privacy and performance stop being opposites: the compliant setup is the faster one. That is the thesis behind how we do measurement and search work generally; you can explore our SEO and growth services at /services/seo/, where GDPR-compliant analytics setup is part of the standard engagement rather than an upsell.