DatascaleGDPR Analytics
Pillar · As of August 2026
GDPR-compliant analytics, without wishful thinking.
What "GDPR-compliant" legally means, which tools carry it, and where GA4 can be retrofitted with effort. This page runs what it describes: cookieless measurement, public at /en/open/.
GDPR-compliant analytics means collecting visitor data only on a valid legal basis, processing it on EU infrastructure, and, where cookies or personal data are involved, obtaining informed consent before any tracking begins. This page shows which tools work sensibly in 2026, which Google Analytics alternative fits which setup, and how a correct setup is built.
Quick Answer
Google Analytics (GA4) can be used in a GDPR-compliant way with a proper DPA, Consent Mode V2, and EU data processing settings. Plausible CE and Piwik PRO are EU-native alternatives that require significantly less consent infrastructure. The right choice depends on whether you run paid advertising campaigns and how much compliance overhead your team can manage.
What GDPR-compliant really means
The GDPR does not demand "no tracking". It demands a traceable legal basis, transparent information for users, the ability to exercise data-subject rights, and technical measures to protect the data. For web analytics that leaves two paths. Either obtain valid consent and accept measurably that a share of users decline. Or use technologies that process no personal data at all and therefore need no banner.
In 2026 the second path is the calmer one. Cookieless, EU-hosted analytics captures aggregated reach data with no cookie, no IP storage, no third-country transfer. No banner, no consent loss, full coverage. The trade-off is less granularity for attribution and retargeting. Anyone running Google Ads with Smart Bidding still needs GA4 and a clean consent setup.
The best GDPR-compliant Google Analytics alternatives
There is no single best alternative, only a best fit per setup. Four tools cover most cases. The decision comes down to three questions: how much attribution depth you need, how much self-hosting effort is acceptable, and how strict the EU-cloud mandate is internally.
Plausible Community Edition is the default for content sites, agencies, and lead-gen without deep attribution. Cookie-free, no banner, GDPR-uncritical, self-hosted in the EU. Details on the Plausible CE page.
Matomo is the more powerful open-source option with full data ownership. It can set cookies and cover heatmaps, session recordings, or A/B tests, at which point a consent banner returns depending on configuration. A fit for flexible setups that need more than plain reach.
Piwik PRO is the enterprise choice from Poland, with EU servers and an integrated CMP. Technically close to GA4, legally far less brittle. The right answer for regulated industries and EU-cloud mandates. More on the Piwik PRO page.
etracker is the German answer for SMBs that want a hosted option without self-hosting. Servers in Hamburg, audited consent-free cookieless tracking as the default mode. Its feature set sits between Plausible and Matomo, entry at €10.80/month.
The five common tools compared
| Criterion | GA4 | Plausible CE | Piwik PRO | Matomo | etracker |
|---|---|---|---|---|---|
| Cookies | Yes (first-party) | None | Optional | Optional | Optional |
| Consent banner | Required | Not required | Configurable | Configurable | No, consent-free mode |
| Hosting | US (Google) | Self-hosted EU | EU (Poland) | Self / EU Cloud | DE (Hamburg) |
| IP anonymisation | Default | No IP stored | Configurable | Configurable | Default |
| Marketing integrations | Strong (Ads) | Minimal | Solid | Solid | Medium |
| Licence cost | €0 | €0 (self-host) | From €36/mo | €0 / from €29/mo Cloud | From €10.80/mo |
| Best fit | Ads-heavy marketing | Content sites, agencies | Enterprise, regulated | Flexible setups | German SMBs |
Prices per the vendors' pricing pages (piwik.pro, matomo.org, etracker.com), accessed 16 August 2026.
Making GA4 GDPR-compliant: the checklist
GA4 stays mandatory when Google Ads runs Smart Bidding, Enhanced Conversions, or audiences. The operation only becomes legally clean with this configuration, defaults are not enough.
- DPA with Google Ireland, not with Google LLC.
- IP anonymisation enabled before data reaches Google.
- Consent Mode V2 wired correctly, with a CMP behind it, not as a replacement for one.
- CMP integration with a pre-consent scan and clean tag categorisation.
- Data retention capped at 14 months instead of the default maximum.
- US transfer decided deliberately and documented, see the next section.
Server-side GTM sits on top: it filters PII before it reaches Google and makes the consent state verifiable server-side. The detail lives in Measurement & Privacy Engineering.
Schrems II and the US data transfer
The sore point of every US tool is the transfer of data to the United States. After the Schrems II ruling (2020) the Privacy Shield fell, and Standard Contractual Clauses alone were no longer enough. Since 2023 the EU-US Data Privacy Framework provides an adequacy basis again for certified US providers, and Google is certified. That puts GA4 on firmer footing than in 2022.
Firmer does not mean final. The EU General Court dismissed the first annulment action in September 2025 (T-553/23, Latombe); the appeal is pending before the CJEU, and the US oversight board PCLOB has lacked a quorum since early 2025. The framework can still fail like both of its predecessors. To avoid the risk, there are two clean exits: EU hosting (Piwik PRO, Matomo, etracker, Plausible CE) or cookieless measurement without personal data. In both cases the transfer question disappears, because no personal transfer takes place.
Do I need a cookie banner?
The banner question is not decided by the tool name but by one technical fact: are cookies set, or is personal data processed that is not technically necessary?
- Cookieless and without PII (Plausible CE, etracker in consent-free mode): no banner needed, no consent required.
- Cookies or personal processing (GA4, Matomo with cookies, ad pixels): consent before the first tag, delivered through a CMP plus Consent Mode V2.
A misconfigured banner is more expensive than none: it destroys data through unnecessary opt-outs and still fails to protect if tags fire before consent. The pre-consent scan is the first checkpoint in every consent audit.
The banner question is not a tool question. It is the question of what you want to measure and what you have to store for it.
Server-side tracking as a data booster
Whatever the tool: server-side GTM (for example via stape.io) improves data quality markedly, because tags run in the server context instead of the browser. Adblockers don't bite, first-party cookies stay valid longer, and third-party forwarding can be controlled. PII is filtered before it reaches Google, and the consent state runs server-side in front of it. Not a trick, but an architectural shift that improves measurement and privacy at once.
Which tool pays off when
Plausible CE is the default when no deep attribution model is needed and the site primarily serves content, leads, or brand awareness. GA4 stays mandatory once Google Ads runs Smart Bidding, Enhanced Conversions, or audiences. Piwik PRO is the pick for enterprise customers with an EU-cloud mandate. Matomo fits when you need full data ownership and more than reach. etracker is the pragmatic middle for German SMBs without self-hosting capacity. In many setups the right answer is a combination: cookieless for reach, GA4 with consent for the ads side.
Next step: settle the stack
Analytics is one building block of four. The full toolbox, CMPs, server-side tagging, warehouse and hosting with a GDPR status per tool, lives in the GDPR tools overview.
Not sure which combination fits your setup? The GDPR Stack Calculator recommends the most sensible mix of analytics tool, consent layer, and hosting in two minutes, based on traffic profile, marketing channels, and industry. If you'd rather have the existing setup reviewed, start with an Audit Sprint: prioritised report, concrete action list, 90-minute walkthrough.
Visitor data is collected only on a valid legal basis, processed on EU infrastructure, and where cookies or personal data are involved, informed consent is obtained before tracking begins. Cookieless, EU-hosted tools clear the first two conditions without a banner.
Conditionally yes: with a DPA with Google Ireland, IP anonymisation enabled, Consent Mode V2 correctly configured, a clean CMP integration and limited data retention. Defaults are not compliant out of the box.
There is no single best one, only a best fit per use case. Plausible Community Edition for content and lead sites without deep attribution, Piwik PRO for regulated industries with an EU-cloud mandate, Matomo for flexible setups with full ownership, etracker for German SMBs that want a hosted option without self-hosting.
No. Plausible Community Edition sets no cookies, stores no IP addresses, and processes no personal data. A consent banner is not required.
Both are privacy-friendly alternatives to GA4. Plausible is cookie-free by default and minimal. Matomo is more powerful but can set cookies, so depending on configuration a consent banner may still be needed. For marketing sites without deep attribution, Plausible is usually the better choice.
For German SMBs, often yes. etracker is hosted in Hamburg and advertises audited consent-free, cookieless tracking as its default mode. The feature set sits between Plausible and Matomo, a solid middle ground for teams that want a hosted German option without self-hosting.
For regulated industries (banking, healthcare) and organisations with strict EU-cloud requirements. The Polish enterprise variant ships with EU servers and an integrated CMP, technically close to GA4 but legally far less brittle.
Defused, not resolved. Since the EU-US Data Privacy Framework (2023) there is again an adequacy basis for certified US providers, and Google is certified. The EU General Court dismissed the first challenge in September 2025 (T-553/23, Latombe); the appeal is pending before the CJEU. To rule out the risk, host in the EU or measure cookielessly, then no personal transfer takes place.
Google's API for controlling tag behaviour based on consent state. Correctly implemented it sends aggregated signals even when consent is declined, which powers conversion modeling. It complements a full GDPR-compliant CMP, it does not replace one.
Run in parallel instead of a hard cut. The new tool runs alongside GA4 for a few weeks so the baseline stays comparable. Historical GA4 data can be preserved via the BigQuery export. Then rebuild events and goals in the new tool, adjust or remove the banner, and switch GA4 off. A Measurement Blueprint keeps the event schema consistent across both tools.
Audit Sprint: €2,400 net fixed price (Starter, tightly scoped) or €3,900 net (Plus, for e-commerce, multiple domains, or app plus web). All prices plus statutory VAT. Included: a prioritised audit report, concrete recommendations, and a 90-minute walkthrough call. Not a strategy paper but a list your dev team can implement directly.
GDPR analytics
Compliant is a setup, not a logo.
The Audit Sprint checks your existing setup on exactly these questions: storage location, signals, banner obligation, with findings instead of opinion.