GDPR tools for marketing and analytics, mapped across the stack
A GDPR tool either works entirely without personal data or collects it only after documented consent. This page lists 24 tools from our integrations catalog with GDPR status, data location and a short verdict; 7 of them run without a consent banner.
What makes a tool GDPR-capable
Three questions decide it, not marketing claims. First, the legal basis: a tool that works without personal data needs no consent. Once cookies, IPs or IDs are processed, a CMP has to document consent before the first tag fires. Second, the data location: EU hosting or self-hosting ends the US-transfer discussion before it starts. Third, consent integration: a tool that cannot be wired cleanly to Consent Mode V2 or the CMP will, in doubt, fire before consent. That is the most common finding in our audits.
This produces the three tiers in the tables. GDPR-ready: runs without personal data, no banner needed. GDPR-configurable: operable cleanly once consent wiring, hosting region or contracts are right. GDPR-critical: usable only with substantial conditions. The rating comes from our integrations catalog, where each tool's assessment is explained.
What this page is not
Not a directory of privacy-management software. If you need tooling for records of processing, DPA management, risk analyses or audit reports, you are looking for GRC software, a separate category your data protection officer should select. This page covers the marketing and analytics stack: the tools that collect, process and activate data, and therefore have to hold up under the GDPR.
Consent & CMP
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| Borlabs Cookie | GDPR-ready | Self-hosted | WordPress CMP from Germany. One-time license, data stays on your own server. |
| Usercentrics | GDPR-ready | EU | Enterprise CMP from Munich. The upper tier to Cookiebot, which belongs to the same company. |
| Cookiebot | GDPR-configurable | EU | For SMBs. Automatic scanning, quick setup. |
| OneTrust | GDPR-configurable | US / Global / Self-hosted | Enterprise CMP. Full configuration complexity, worth it at scale. |
Web & Marketing Analytics
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| Plausible Community Edition | GDPR-ready | Self-hosted / EU | Self-hosted, cookieless. Our default where granularity isn't critical. |
| Firebase Analytics | GDPR-configurable | US / Global | Required for app tracking. GDPR-compatible when configured correctly. |
| Matomo | GDPR-configurable | EU | Open-source classic, darling of the DACH public sector. 100% data ownership, UI a bit dated. |
| Piano Analytics | GDPR-configurable | EU | European analytics leader with maximum GDPR safety (CNIL exemption). Strong for publishers and media. |
| Piwik PRO | GDPR-configurable | EU | EU-hosted, enterprise-grade. The GA4 alternative for consent-critical projects. |
| GA4 | GDPR-critical | US / Global | Web standard. Configurable with care, but the defaults are problematic. |
Server-Side & Tag Management
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| Google Tag Manager | GDPR-configurable | US / Global | The standard tag manager for the web. Free, huge ecosystem, needs governance. |
| Google Tag Manager Server-Side | GDPR-configurable | EU | Standard tag management, server-side. All containers follow a naming convention. |
| JENTIS | GDPR-configurable | EU | Privacy-focused server-side tracking platform from Austria. Twin-Server technology and data reduction before forwarding. |
| stape.io | GDPR-configurable | EU | Managed server-side GTM hosting in the EU region. Fast start, no GCP overhead. |
Event Collection & CDI
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| Snowplow | GDPR-ready | Self-hosted / EU | Open-source behavioral-data platform, schema-validated and self-hostable. The cookieless first-party foundation. |
| RudderStack | GDPR-configurable | Self-hosted / EU / US | Open-source event streaming and CDP for engineering teams. Segment-API-compatible, no marketer UI. |
| Segment | GDPR-configurable | EU | Industry leader in event routing. Great UI and ecosystem, but strong lock-in and aggressive pricing. |
Data Warehouse
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| BigQuery | GDPR-configurable | EU | EU region (europe-west3) by default. Our default for the Marketing Lakehouse. |
| ClickHouse | GDPR-configurable | EU | Blazing fast columnar database for real-time analytics. Open-source, self-hostable in the EU. |
| Snowflake | GDPR-configurable | EU / Global | Alternative for a multi-cloud strategy. EU region. |
Marketing Automation & Lifecycle
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| Brevo | GDPR-ready | EU | Marketing automation from Paris. Email, SMS and WhatsApp, GDPR-native and affordable. |
| Klaviyo | GDPR-configurable | US | Leading e-commerce ESP for email and SMS automation. We implement it where it fits. |
Hosting & Infrastructure
| Tool | GDPR status | Hosting | Verdict |
|---|---|---|---|
| Coolify | GDPR-ready | Self-hosted / EU | Self-hosted deployment platform on Hetzner EU. Astro SSR and Plausible CE run on it. |
| Hetzner Cloud | GDPR-ready | EU | German servers. All Datascale infrastructure runs here. |
How to combine the tools
Two routes cover most setups. The cookieless route: Plausible CE or etracker, EU or self-hosting, no banner, full coverage. The price is less attribution depth. The consent route: GA4 or Piwik PRO behind a properly wired CMP, plus server-side tagging that filters PII and makes the consent state verifiable server-side. Mandatory once Google Ads runs with Smart Bidding.
For the analytics decision in detail, GDPR-compliant analytics compares GA4, Plausible, Piwik PRO, Matomo and etracker, including the cookie-banner question. To get the right combination for your setup, the GDPR stack calculator answers it in two minutes. And whether your current setup keeps what the banner promises: theMeasurement Health Check shows it in under 20 seconds.
What is a GDPR tool?
A tool that either works without personal data (cookieless, no IP storage, EU-hosted) or can be configured so data collection only starts after documented consent. Three questions decide it: legal basis, data location and consent integration.
Is Google Analytics 4 a GDPR tool?
Not with default settings. GA4 needs a DPA with Google Ireland, IP anonymisation, Consent Mode V2 and a properly wired CMP in front of it; then operation is possible with conditions. Teams that want to avoid the transfer risk entirely pick an EU alternative such as Plausible CE or Piwik PRO.
Which tools work without a cookie banner?
Tools that set no cookies and process no personal data: Plausible CE, etracker in Signalize mode, and server-side setups without PII. As soon as cookies or personal processing enter (GA4, ads pixels, Matomo with cookies), consent before the first tag is mandatory.
Are US tools automatically GDPR-critical?
No, but they carry the transfer question. Since the EU-US Data Privacy Framework (2023) there is an adequacy basis for certified vendors; it remains under political scrutiny. EU hosting or self-hosting takes the question off the table entirely, which is why we list the data location per tool.
Where do I find privacy-management software (RoPA, DPA management, audits)?
Not here. This page covers the marketing and analytics stack. Software for records of processing, DPA management or privacy audits is its own category (GRC), best selected by a data protection officer.
Which GDPR tools fit agencies?
Agencies need multi-client setups: self-hosted Plausible CE scales across many client sites at fixed cost, Usercentrics and Cookiebot cover CMP operations per client, stape.io hosts one server-side container per client. The stack calculator helps combine them per client profile.