GDPR-Compliant Analytics

What GDPR-compliant really means

The GDPR does not demand "no tracking". It demands a traceable legal basis, transparent information for users, the ability to exercise data-subject rights, and technical measures to protect the data. For web analytics that leaves two paths. Either obtain valid consent and accept measurably that a share of users decline. Or use technologies that process no personal data at all and therefore need no banner.

In 2026 the second path is the calmer one. Cookieless, EU-hosted analytics captures aggregated reach data with no cookie, no IP storage, no third-country transfer. No banner, no consent loss, full coverage. The trade-off is less granularity for attribution and retargeting. Anyone running Google Ads with Smart Bidding still needs GA4 and a clean consent setup.

The best GDPR-compliant Google Analytics alternatives

There is no single best alternative, only a best fit per setup. Four tools cover most cases. The decision comes down to three questions: how much attribution depth you need, how much self-hosting effort is acceptable, and how strict the EU-cloud mandate is internally.

Plausible Community Edition is the default for content sites, agencies, and lead-gen without deep attribution. Cookie-free, no banner, GDPR-uncritical, self-hosted in the EU. Details on thePlausible CE page.

Matomo is the more powerful open-source option with full data ownership. It can set cookies and cover heatmaps, session recordings, or A/B tests, at which point a consent banner returns depending on configuration. A fit for flexible setups that need more than plain reach.

Piwik PRO is the enterprise choice from Poland, with EU servers and an integrated CMP. Technically close to GA4, legally far less brittle. The right answer for regulated industries and EU-cloud mandates. More on the Piwik PRO page.

etracker is the German answer for SMBs that want a hosted option without self-hosting. Servers in Hamburg, cookieless operation, banner-free release in privacy-first mode. Its feature set sits between Plausible and Matomo.

The five common tools compared

Making GA4 GDPR-compliant: the checklist

GA4 stays mandatory when Google Ads runs Smart Bidding, Enhanced Conversions, or audiences. The operation only becomes legally clean with this configuration, defaults are not enough.

• DPA with Google Ireland, not with Google LLC.
• IP anonymisation enabled before data reaches Google.
• Consent Mode V2 wired correctly, with a CMP behind it, not as a replacement for one.
• CMP integration with a pre-consent scan and clean tag categorisation.
• Data retention capped at 14 months instead of the default maximum.
• US transfer decided deliberately and documented, see the next section.

Server-side GTM sits on top: it filters PII before it reaches Google and makes the consent state verifiable server-side. The detail lives inMeasurement & Privacy Engineering.

Schrems II and the US data transfer

The sore point of every US tool is the transfer of data to the United States. After the Schrems II ruling (2020) the Privacy Shield fell, and Standard Contractual Clauses alone were no longer enough. Since 2023 the EU-US Data Privacy Framework provides an adequacy basis again for certified US providers, and Google is certified. That puts GA4 on firmer footing than in 2022.

Firmer does not mean final. The framework is politically contested and could fail before the CJEU like both of its predecessors. To avoid the risk, there are two clean exits: EU hosting (Piwik PRO, Matomo, etracker, Plausible CE) or cookieless measurement without personal data. In both cases the transfer question disappears, because no personal transfer takes place.

Do I need a cookie banner?

The banner question is not decided by the tool name but by one technical fact: are cookies set, or is personal data processed that is not technically necessary?

• Cookieless and without PII (Plausible CE, etracker Signalize): no banner needed, no consent required.
• Cookies or personal processing (GA4, Matomo with cookies, ad pixels): consent before the first tag, delivered through a CMP plus Consent Mode V2.

A misconfigured banner is more expensive than none: it destroys data through unnecessary opt-outs and still fails to protect if tags fire before consent. The pre-consent scan is the first checkpoint in every consent audit.

Server-side tracking as a data booster

Whatever the tool: server-side GTM (for example via stape.io) improves data quality markedly, because tags run in the server context instead of the browser. Adblockers don't bite, first-party cookies stay valid longer, and third-party forwarding can be controlled. PII is filtered before it reaches Google, and the consent state runs server-side in front of it. Not a trick, but an architectural shift that improves measurement and privacy at once.

Next step: settle the stack

Analytics is one building block of four. The full toolbox, CMPs, server-side tagging, warehouse and hosting with a GDPR status per tool, lives in the GDPR tools overview.

Not sure which combination fits your setup? TheGDPR Stack Calculator recommends the most sensible mix of analytics tool, consent layer, and hosting in two minutes, based on traffic profile, marketing channels, and industry. If you'd rather have the existing setup reviewed, start with an Audit Sprint: prioritised report, concrete action list, 90-minute walkthrough.