Privacy and compliance
What the regulation actually asks of an analytics tool, which claims are meaningful, and the questions worth putting to a vendor before you sign.
No analytics tool is GDPR compliant on its own, and any vendor claiming otherwise is describing a property that does not exist. Compliance is a property of how you deploy and document a tool, not of the software in isolation. What a tool can do is make compliance easy or make it a project.
This page is a lay reading of how these products work, drawn from their own technical documentation. It is not legal advice, and if this matters to your organisation you should take proper advice. What it can do is tell you which questions are worth asking, because most buyers ask the wrong ones.
The obligation that bites hardest comes from the ePrivacy rules rather than GDPR itself, and it attaches to storing or accessing information on a visitor's device. A cookie does that. So does local storage, and so does a device fingerprint.
If your analytics does any of those things, you need consent before it runs, which in practice means a banner, which means losing the visitors who decline. If it does none of them, the consent question largely falls away for analytics purposes, and several European data protection authorities have published guidance to that effect for genuinely anonymous measurement.
This is why the cookieless question and the GDPR question are really the same question wearing different clothes. Solve the first and the second becomes far smaller.
European regulators and the courts have consistently treated an IP address as personal data, because it can be combined with other information to identify someone. That makes storing one a processing activity requiring a lawful basis, a retention policy and a place in your records.
The tools that never write an IP address anywhere sidestep this entirely. The useful distinction is between a tool that anonymises an IP after storing it, a tool that stores a hash of it, and a tool that holds it in memory for one request and discards it before the response is sent. Only the third has genuinely removed the obligation, and the difference is visible in the vendor's own technical documentation if you read it.
Sending personal data outside the UK or EEA needs a transfer mechanism, and the history here has been unstable enough that many organisations have simply decided to keep analytics data in Europe and stop thinking about it.
That is why EU hosting appears on so many vendor pages. Plausible hosts in the EU on European-owned infrastructure, Pirsch in Germany, Simple Analytics and Contentsquare in the EU, Statcounter in Ireland. Fathom is Canadian with EU isolation available. Absolutely Analytics lets you choose the storage jurisdiction directly.
If no personal data is ever stored, the transfer question is much less pressing, which is another reason the architecture matters more than the marketing.
GDPR gives people the right to access, rectify and erase their personal data. Here is the part that surprises people: a tool that genuinely stores nothing identifying cannot fulfil a subject access request, and that is the correct outcome rather than a failure. There is no record to produce, because there is no record.
A tool that does store identifiers has the opposite problem. You need a documented process for finding and deleting one visitor's data on request, and you need to be able to do it within a month. Ask any vendor holding identifiers how that request is actually serviced, because the answer is often less developed than the sales material implies.
Five, in this order, and they will tell you more than a compliance page will.
Is an IP address ever written to any persistent store, and if so for how long? Can you recompute last week's visitor identifiers from what you still hold? Where is the data physically stored, and can I choose? What exactly does your data processing agreement cover, and will you sign ours? And if a visitor asks for their data, what is the process and how long does it take?
A vendor whose architecture is genuinely privacy-preserving answers all five quickly and in technical terms. A vendor whose privacy is a policy rather than a design tends to answer with a link to a compliance page.
| Tool | From | Free tier | Cookies | Score |
|---|---|---|---|---|
| Absolutely Analytics | $9 per month | No free tier. A 30-day trial of the exact tier you picked | None, so no consent banner | 8.9 |
| Plausible Analytics | £9 per month | No, but the community edition is free to self-host | None, so no consent banner | 8.0 |
| Piwik PRO | Free core tier, then quoted | Yes, a Core tier with a monthly action limit | Optional, and it runs cookieless if you configure it to | 6.4 |
| Matomo | Free self-hosted; cloud from €22 | Yes, the entire on-premise product | Optional, and it runs cookieless if configured | 7.0 |
| Simple Analytics | $20 per month | Yes, for hobby sites: five websites, one month of history, badge required | None, so no consent banner | 6.9 |
The easiest compliance story here: no cookie, no IP stored anywhere, identifiers that cannot be recomputed across days, and a choice of storage jurisdiction. There is no subject access process because there is no subject data.
From $9 per month · None, so no consent banner · Full review →
EU-hosted on European-owned infrastructure, open source so the claims are inspectable, and six years of operating history behind the compliance posture.
From £9 per month · None, so no consent banner · Full review →
The pick when a data protection officer has veto power. Built-in consent management, EU, US or on-premise hosting, granular retention and anonymisation controls, and the governance features a regulated buyer is asked to evidence.
From Free core tier, then quoted · Optional, and it runs cookieless if you configure it to · Full review →
Self-host it and the transfer question never arises, because nothing leaves your infrastructure. Configure it for cookieless operation with IP anonymisation and the consent question largely goes too.
From Free self-hosted; cloud from €22 · Optional, and it runs cookieless if configured · Full review →
EU-hosted, cookieless, and unusually well set up to run as a second measurement layer beside a consented enterprise suite, with SOC 2 and warehouse export for procurement.
From $20 per month · None, so no consent banner · Full review →
GA4 can be deployed in ways intended to be compliant, using consent mode, IP handling controls and data processing terms, but it requires consent because it sets cookies, and several European data protection authorities have previously found specific configurations unlawful before Google reworked them. The practical consequence is a banner and the visitors it costs you.
If the tool sets a cookie or stores an identifier on the device, yes. If it is genuinely cookieless and retains no identifier, the consent obligation for analytics largely falls away. You may still need a banner for other things on your site, such as embedded video, advertising tags or chat widgets.
It removes the international transfer question, which is one requirement among several. It does not address consent, lawful basis, retention, subject rights or your privacy notice. EU hosting is useful and is not, on its own, compliance.
Either a self-hosted tool such as Matomo, where nothing leaves your infrastructure, or a cookieless hosted tool that stores no identifiers and lets you pick the storage jurisdiction. Piwik PRO sits between the two and is the usual choice where governance features have to be evidenced to an auditor.
Everything above is my own opinion, formed from published vendor documentation and pricing read on 11 September 2026. There are no affiliate links on this site and no vendor has paid to appear. Corrections welcome.