GDPR Compliant Analytics: Tools, Consent and EU Transfers

GDPR-compliant analytics means measuring your website without breaking EU data protection rules or your visitors’ trust.

In practice, it comes down to three questions: what data the tool collects, where that data goes, and on what legal basis.

Pick a tool that avoids personal data, keeps it in the EU and comes with a signed DPA. That covers most of the work.

This guide covers the legal requirements, cookie consent, EU-US transfers, GA4, the main tools, and how to set up privacy-friendly tracking.

What GDPR Requires From Your Analytics

Two EU laws apply at once. GDPR covers personal data, and the ePrivacy Directive covers anything stored on a visitor’s device.

Requirement	What it means for analytics
Lawful basis	Consent or legitimate interest, chosen and documented for each purpose
Data minimization	Collect only the metrics you actually use
Purpose limitation	Don’t reuse analytics data for ads unless that purpose is covered
Storage limitation	Set a retention period and delete older raw data
Processor contract	Sign a data processing agreement (DPA) with your vendor, as Article 28 requires
Transfers	Data leaving the EU needs an adequacy decision or another safeguard
Device access	Cookies and similar storage need consent unless strictly necessary

Fines for the most serious breaches can reach €20 million or 4% of worldwide annual turnover, whichever is higher.

The good news is simple: the less personal data your tool touches, the fewer of these rules come into play.

Consent or Legitimate Interest?

Every analytics setup needs a lawful basis under GDPR. For most websites, it’s one of two options.

Consent. The usual basis when the tool sets cookies or reads the device, because ePrivacy rules apply first.
Legitimate interest. Comes up for cookieless, anonymous measurement that doesn’t touch the device.

If you rely on legitimate interest, write a short assessment that weighs your need against visitors’ privacy, and keep it on file.

Do You Need a Cookie Banner?

Consent depends on what the tool does in the browser, not on the word “cookieless” on its homepage.

Analytics cookies or local storage. Consent is needed in most EU countries, unless a national exemption applies.
No cookies, but device fingerprinting. That still reads information from the device, so treat it as needing consent.
No cookies, no device storage, anonymous counts. Often no banner is needed, but your national regulator has the final word.

France shows how an exemption works. The CNIL lets audience measurement skip consent when the tool meets strict conditions.

It measures audience only, and only for the site owner.
It produces anonymous statistics and nothing more.
Data isn’t matched with other processing or shared in identifiable form.
It doesn’t follow visitors across other sites or apps.

The CNIL also recommends a cookie lifetime of about 13 months and keeping collected data no longer than 25 months.

For a full breakdown of banner rules, see our guide: Do You Really Need a Cookie Banner?

Sending Data Outside the EU

Transfers to the US are why regulators went after Google Analytics. The legal ground has shifted twice since 2020.

July 2020. The EU Court of Justice struck down the Privacy Shield in its Schrems II ruling.
February 2022. France’s CNIL ordered website operators to bring their Google Analytics transfers to the US into compliance.
July 2023. Sweden’s regulator fined Tele2 SEK 12 million and CDON SEK 300,000 over Google Analytics.
July 10, 2023. The European Commission adopted the EU-US Data Privacy Framework (DPF) adequacy decision.
September 1, 2023. Google started relying on the DPF for EEA data in its ads and analytics products.
September 3, 2025. The EU General Court dismissed a challenge to the DPF in case T-553/23.
October 31, 2025. The challenger appealed to the Court of Justice, so the question isn’t fully closed.

Today, personal data can flow from the EU to US companies certified under the DPF without extra safeguards.

Check your vendor on the official DPF list, and keep an exit plan in case the appeal changes the picture.

For the country-by-country story, read Google Analytics and GDPR: why EU businesses are switching.

GA4 and GDPR: What’s Actually True

Before switching, understand what you lose and gain when leaving Google Analytics. Then look at GA4 as it works today.

IP addresses. Google says GA4 doesn’t log or store IP addresses, so IP anonymization isn’t a setting you need.
EU collection. Data from EU devices is collected through EU servers before Google forwards it for processing.
Granular data. You can switch off granular location and device data, and Google signals, region by region.
Retention. Standard properties keep event-level data for either 2 or 14 months.
Cookies. GA4 sets first-party cookies, so you need consent wherever cookie rules apply.
Consent mode. For EEA traffic, Google expects consent signals, including ad_user_data and ad_personalization.
Transfers. Data still reaches Google in the US, which relies on the DPF for EEA data.

So GA4 can be run lawfully, but only with a banner, Google’s data processing terms, the right settings and a documented transfer basis.

Many EU teams find a cookieless tool easier to defend. If you decide to switch, follow our migration checklist.

Best GDPR-Compliant Analytics Tools

These four tools were built with privacy in mind. They differ on hosting, cookies and price, so match them to your setup.

Plausible Analytics

Plausible is an open-source tool built and hosted in the EU. It uses no cookies and never stores raw IP addresses.

Unique visitors come from a daily hash of IP, user agent and domain. The salt is rotated and deleted every 24 hours.

Best for: blogs, marketing sites and small businesses that want simple, readable metrics.

Pricing: Starter is $9/month for 10k monthly pageviews and one site. Self-hosting the Community Edition is free.

Fathom Analytics

Fathom is a Canadian company with a cookie-free tracker and a polished dashboard.

Its EU isolation routes EU visitors through European servers. The IP address is stripped there, before anonymized data reaches its US infrastructure.

Best for: businesses that want a refined interface, several sites and no server to run.

Pricing: from $15/month for up to 100,000 monthly pageviews, with 50 sites included and a 7-day trial.

Matomo

Matomo is the most feature-rich option here. Matomo Cloud stores data in Frankfurt, or you can host it yourself.

It runs with or without cookies, and its CNIL mode applies the French consent exemption, with IP masking and User ID turned off.

Best for: organizations that need detailed reports, funnels, goals and full control over hosting.

Pricing: Cloud starts at $26/month (€22) for 50,000 hits. Self-hosting the On-Premise edition is free.

Umami

Umami is a lightweight, open-source and cookieless tool that developers like to self-host.

Umami Cloud runs servers in the US and the EU, so confirm where your data will live before you sign up.

Best for: developers who are comfortable with self-hosting and want minimal overhead.

Pricing: Cloud has a free Hobby plan up to 100K events a month, and Pro is $20/month. Self-hosting is free.

Quick Comparison

Tool	Cookies	Where data lives	Self-host	Starting price
Plausible	No	EU	Yes	$9/mo
Fathom	No	EU traffic anonymized in the EU, stored in the US	No	$15/mo
Matomo	Optional	Frankfurt (Cloud) or your own server	Yes	$26/mo (Cloud)
Umami	No	US or EU (Cloud) or your own server	Yes	Free tier, Pro $20/mo

How to Check Any Analytics Tool

Vendor badges don’t prove much. Spend an hour on these checks before you sign anything.

Subprocessors. Find the list and note which companies touch the data, and in which countries.
DPA. Read it. It should name the vendor as your processor and describe its security measures.
Transfer basis. Look for EU-only processing, DPF certification, or standard contractual clauses.
Browser storage. Open your site in a private window and check cookies and local storage before any consent.
Network requests. In developer tools, see where tracking requests go and what each payload contains.
Visitor counting. Ask how unique visitors are counted. A hash with a daily salt identifies people far more briefly than a persistent ID.
Retention. Confirm you can set how long raw data is kept, and that deletion actually happens.
Data reuse. Ask whether the vendor uses your data for its own purposes. That breaks the CNIL exemption.

Important: “Cookieless” doesn’t automatically mean compliant. The data also has to stay in the EU or under adequate safeguards.

Setup Checklist

Follow these steps to put GDPR-compliant analytics in place on your site.

Choose the tool. Plausible, Fathom, Umami, or Matomo configured for your consent setup.
Verify hosting. Check where the provider stores and processes data, including backups.
Sign the DPA. Keep a signed copy with your records of processing.
Record your lawful basis. Write down whether you rely on consent or legitimate interest, and why.
Set retention. Pick a period that matches your reporting needs, not the longest one available.
Update your privacy policy. Name the tool, what it collects, where data goes and for how long.
Remove unneeded tracking. Turn off features and events you don’t use in reports.
Test without consent. Confirm no analytics cookies are set before a visitor agrees.

What About Self-Hosting?

Self-hosting Matomo, Umami or Plausible gives you full control, and the data never leaves servers you choose.

You stay the data controller, and your hosting company becomes your processor. That brings a few extra jobs.

Securing the server and database, including updates.
Managing backups and deleting data on schedule.
Answering access and deletion requests from visitors.

For most small businesses, a managed cloud plan with EU hosting is simpler than running your own server.

Bottom Line

GDPR-compliant analytics don’t have to be complicated. Start with a tool that collects as little personal data as possible.

Then check hosting and transfers, sign the DPA, and test what happens before consent. Those steps answer most questions a regulator would ask.

If you stay on GA4, budget for a banner, consent mode and careful settings. If that sounds heavy, a cookieless tool is the shorter path.

Plan prices and legal dates in this guide were re-checked in November 2026.

GDPR-Compliant Analytics: Complete Guide