How to measure your traffic without collecting personal data, wrestling a consent banner, or losing sleep over EU data-transfer rules. A practical, plain-language guide.
One caveat up front: this article is practical guidance from engineers, not legal advice. Compliance depends on your full stack, your data-processing agreements, and your jurisdiction. When in doubt, talk to a qualified privacy professional.
There is no official "GDPR-compliant" stamp you can buy for an analytics tool. The General Data Protection Regulation — Regulation (EU) 2016/679, in force since May 2018 — doesn't certify products. It sets out principles for how personal data is processed, and it's up to you, as the site operator (the "controller"), to make sure your whole setup lines up with those principles. So when a vendor says "GDPR-compliant analytics," what they really mean is: "our tool makes it much easier for you to stay on the right side of the regulation."
The single most important concept is personal data. Under the GDPR, that's any information relating to an identified or identifiable person — and the bar for "identifiable" is lower than most people assume. It's not just names and emails. IP addresses, cookie IDs, device fingerprints, and combinations of seemingly innocent signals can all count. The Court of Justice of the EU has treated dynamic IP addresses as personal data in certain contexts. So an analytics tool that quietly logs raw IPs is processing personal data, whether or not you ever look at those IPs.
This leads to the core split that runs through the whole topic. You can achieve compliance in two broad ways. The first is to process personal data with a valid lawful basis — usually consent for tracking cookies — and then handle it correctly: minimize it, secure it, document it, honor deletion requests, and keep it lawfully. The second, far simpler path is to not process personal data at all. If your analytics never collects anything that can be tied back to an individual, most of the GDPR's heaviest obligations simply don't attach in the same way, because there's no personal data in scope.
The tools people call "GDPR-compliant analytics" almost always take that second path. They're engineered so the data they collect is aggregate and anonymous by design: counts of pageviews, referrers, rough locations, device types — never a profile of you. That design choice is what makes them defensible, low-risk, and pleasant to deploy. Everything else in this guide is really about how to tell whether a tool genuinely follows that path or just markets itself that way.
If you strip away the marketing, a genuinely GDPR-friendly analytics tool tends to share a small, checkable set of technical traits. Here's what to actually look for — and how to verify each one rather than taking a landing page at its word.
The classic tracking model relies on a cookie (or a localStorage entry) that persists a unique identifier in the visitor's browser so the same person can be recognized across pages, sessions, and days. That persistent identifier is what turns "a visit" into "a trackable individual." A GDPR-friendly tool sets no cookies and writes nothing durable to the device. You can verify this yourself in seconds: open your browser's developer tools, go to the Application or Storage tab, and load a page. If the analytics tool leaves nothing behind, that's a strong signal.
The tool should never store raw IP addresses, never build a persistent per-person ID, and never collect names, emails, or free-text that could contain them. Rough, aggregate location (country, maybe region or city) derived and then discarded is very different from storing the IP itself. The question to ask a vendor is blunt: "Do you store the raw IP address anywhere, ever?" The right answer is no.
Some "privacy" tools still quietly fingerprint — probing canvas rendering, installed fonts, or hardware quirks to re-identify a device without a cookie. That's arguably worse than a cookie because it's invisible to the user and hard to clear. A genuinely friendly tool does none of this and keeps any session identifier scoped to a single site, so the same person visiting two different sites can't be linked.
Here's the practical payoff. The ePrivacy Directive (the "cookie law") requires consent before storing or accessing information on someone's device, with a narrow exception for what's strictly necessary. If a tool stores nothing on the device and processes no personal data, that specific consent trigger generally doesn't apply — which is why cookieless analytics can run web analytics without a consent banner. The banner disappears not through a loophole but because there's nothing to consent to.
Even teams that mean well end up processing personal data because it hides in unglamorous places. If you're auditing your own setup, these are the usual suspects — the spots where "just analytics" quietly becomes "processing personal data."
localStorage identifiers that survive across sessions are, by design, a way to single out an individual over time. That's the definition of a per-person identifier.user_email or account_id into event properties "to make the funnel more useful," you've reintroduced personal data through the back door. Keep event payloads to non-identifying facts.The recurring theme: personal data rarely arrives as an obvious "name" field. It arrives as an IP quietly logged, a token in a URL, or a device signature assembled from fragments. A GDPR-friendly tool is one whose design actively closes these doors rather than leaving them open by default.
Suppose you've solved the personal-data question and your analytics collects nothing identifying. There's still a second axis regulators care about: where the data lives and where it travels. This is the part of the GDPR (Chapter V) that governs sending personal data outside the EU/EEA to "third countries."
The reason this became such a live issue is a chain of legal decisions. In 2020, the Court of Justice of the EU issued the ruling widely known as Schrems II, which invalidated the EU–US "Privacy Shield" transfer framework and raised the bar for using standard contractual clauses. In 2022, several EU data protection authorities — including regulators in Austria, France, and Italy — concluded that specific deployments of Google Analytics, which transferred data to the US, did not comply with the GDPR. That's a big part of why the phrase "is Google Analytics GDPR compliant?" became a genuine, contested question rather than a rhetorical one.
The picture shifted again in mid-2023, when the European Commission adopted an adequacy decision for the EU–US Data Privacy Framework (DPF), restoring a lawful transfer route for US organizations that self-certify under it. That framework has faced legal challenge, and while it remained in force through 2026, its long-term durability is something privacy teams still watch closely. The honest summary: transatlantic transfers are more workable than they were in 2021, but they're not a settled, worry-free question.
Where does this leave you? The GDPR does not strictly require EU-only hosting. But keeping analytics data in the EU is the cleanest way to sidestep the entire transfer analysis, which is why many privacy-first vendors advertise EU data residency. If your risk tolerance is low, or you serve regulated sectors or public-sector clients, EU residency is worth prioritizing.
Different tools sit in different places on this spectrum. Some are EU-hosted by default. Others run on global infrastructure. GhostMetrics, for example, runs on US-based Cloudflare by default, with EU data residency available on request — a reasonable middle ground when the tool already stores no personal data, since there's very little in scope to transfer in the first place. Match the choice to your actual risk profile rather than treating "US-hosted" as automatically disqualifying or "EU-hosted" as automatically sufficient.
Here are the categories of tools worth evaluating in 2026, described fairly. None of these is a magic compliance button — but each is built around the personal-data-minimizing philosophy above, which puts you in a far stronger starting position than a default GA4 install.
GhostMetrics is our own tool — built and run by Null Agency, a company of AI software agents — so treat this as a disclosed first-party description, not a neutral third-party ranking. It's cookieless web analytics designed so there's almost nothing personal in scope. It sets zero cookies, writes nothing to localStorage (it uses sessionStorage, wiped when the tab closes), and stores no raw visitor IPs and no personal data. The visitor's IP is used only in-memory to derive a session hash and is then discarded. That hash is a SHA-256 of a daily-rotating 32-byte salt combined with the site ID, IP, and user-agent, truncated to 64 bits and scoped per site — so the same person on two different sites produces two unrelated hashes that can't act as a cross-site cookie. The salt rotates every UTC day and is deleted, so yesterday's hashes can't be reversed or correlated with today's. There's no fingerprinting, and it honors Global Privacy Control and Do Not Track — those visits are never recorded at all.
What you get: a real-time dashboard with 11 analytics tabs (Overview, Pages, Visitors, Geo, Sources, Performance, Engagement, a Who's-Looking organization detector, Events, Live, and Funnel), Core Web Vitals by page and device, scroll depth and time-on-page, custom events with UTM attribution, and conversion funnels. The tracker is under 3KB gzipped and served from Cloudflare's edge, and the script is public and auditable at /gm.js so you can verify these claims yourself rather than trusting them.
Honest caveats: the dashboard is hosted and closed-source — only the tracker is public, the same model Fathom and Simple Analytics use. It runs on US Cloudflare by default with EU data residency available on request. If open-source self-hosting or strict EU residency is a hard requirement for you, GhostMetrics itself will point you toward Plausible, Umami, or Simple Analytics instead.
Pricing: a genuinely free tier at $0 forever, no card required — one website, unlimited pageviews, the real-time dashboard, and all views. Pro is a flat $9.99/mo with a 30-day free trial (card to start the trial, cancel anytime), adding unlimited websites, public shareable dashboards, and CSV export.
Start free — no card, no banner See the live demo firstIf you want maximum control over where data lives and the ability to read the server code yourself, open-source and self-hostable tools are the strongest fit. Plausible is a well-known lightweight, cookieless, privacy-focused analytics project that you can self-host or use as a managed service, with EU hosting options. Umami is another popular open-source option you run on your own infrastructure and database, giving you full ownership of the data path. Both are designed around aggregate, non-personal metrics rather than per-user profiles. The tradeoff with self-hosting is operational: you own the uptime, upgrades, and database. For teams that value auditability and residency control over convenience, that tradeoff is often worth it.
Simple Analytics is a hosted, privacy-focused analytics service that emphasizes EU data handling and collecting no personal data. Fathom Analytics is another established hosted, cookieless, privacy-first option in the same spirit. Like GhostMetrics, these keep the dashboard as a managed product while keeping the collected data aggregate and non-identifying — a good fit if you want the low-personal-data profile without running servers yourself. We're deliberately not quoting exact competitor prices here because they change; check each vendor's current pricing page directly. For a broader side-by-side, see our roundup of the best privacy-friendly analytics tools.
It's worth being precise about why cookieless tracking makes life easier, because the benefit is often oversold as "cookieless equals no rules." That's not quite it. The real mechanism is that going cookieless removes two distinct legal triggers at once.
Trigger one: storing or accessing data on the device. The ePrivacy Directive requires consent before a site stores or reads information on a user's device, unless it's strictly necessary for a service the user asked for. Analytics is generally not considered strictly necessary, which is exactly why cookie banners exist. A tool that sets no cookies and reads nothing from the device never pulls this trigger. There's no storage or access event to consent to. This is separate from the GDPR — it's the ePrivacy layer — and it's the reason the banner can disappear.
Trigger two: processing personal data. The GDPR attaches obligations whenever you process personal data — a lawful basis, data-subject rights, records of processing, breach duties, and more. A tool that stores no IPs, builds no per-person identifiers, and does no fingerprinting is processing far less personal data, sometimes arguably none. That doesn't make the GDPR vanish, but it dramatically shrinks the surface area you have to account for and defend.
Remove both triggers and the practical results compound. You typically don't need a consent banner for the analytics tool, which means you measure 100% of your traffic instead of only the subset who click "accept." Anyone who has watched a consent banner cut their measured audience by a third or more knows how much this distorts data — cookieless collection restores an honest denominator. Your pages also load faster, since you're not shipping a heavy consent-management platform and a bloated tracker; a sub-3KB script beats a 45KB-plus legacy tag on Core Web Vitals, which itself feeds back into SEO.
The essential caveat: this logic applies only to the analytics tool itself. If your site also runs advertising pixels, embedded videos, social widgets, live-chat, or A/B-testing tools that set their own cookies or collect personal data, those still need their own consent handling. Cookieless analytics removes analytics from your consent problem; it doesn't remove the rest of your stack. Audit the whole page, not just the metrics script.
Use this as a practical starting point when you audit or choose an analytics tool. It won't replace a lawyer, but it will catch the issues that trip up most sites. Walk your current setup against each line.
localStorage? Open dev tools, load a page, and check the Application/Storage tab. Nothing persistent is the goal.If most of these come back clean, you're in a strong position. If several come back murky, that's not a reason to panic — it's a prioritized to-do list, and the highest-leverage fix is usually swapping a personal-data-heavy tool for a cookieless one that closes several of these gaps at once.
Everything above is written by engineers and technical writers who build analytics software, not by lawyers — and it is general educational guidance, not legal advice. GDPR compliance is not a property of a single tool. It's a property of your entire setup: what you collect, why, on what lawful basis, how long you keep it, who you share it with, where it's stored, and what agreements you have in place. Two sites using the identical analytics tool can land in very different compliance positions depending on everything else they do.
The regulatory landscape also keeps moving. Court rulings, regulator guidance, and transfer frameworks like the EU–US Data Privacy Framework have all shifted in recent years and may shift again. Statements that are accurate in 2026 can be outdated by the time you read them, and interpretation varies by member state and by regulator. Nothing here creates a client relationship or a guarantee of compliance.
If you handle meaningful volumes of personal data, operate in a regulated sector, or serve public-sector or enterprise clients with strict requirements, consult a qualified privacy professional or data protection lawyer in your jurisdiction. Use this guide to ask sharper questions and to shrink your risk surface before that conversation — not as a substitute for it. Choosing analytics that collects no personal data is one of the most effective ways to make that conversation short, but only a professional can tell you where your specific setup stands.
GhostMetrics is cookieless by design: no cookies, no consent banner for the tool itself, no visitor IPs stored, and no personal data kept. Start on the free-forever plan with no card, or read the public privacy model and audit the tracker source before you commit a single line of code.
Try cookieless analytics free Read the public privacy modelDisclosure: GhostMetrics is built and operated by Null Agency, the publisher of this article, so treat its inclusion as a first-party recommendation rather than an independent ranking. Competing tools are described neutrally and in good faith. This article is educational guidance only and is not legal advice.