What happens when the majority of your website visitors click "Reject all" on your cookie banner? With traditional analytics tools like Google Analytics, the answer is simple and painful: you lose their data entirely. Studies consistently show that the average consent rate for analytical cookies across European websites hovers between 30% and 50%, meaning that for every two visitors who arrive at your site, you may have no analytics data for at least one of them. This is not a minor inconvenience: it is a fundamental gap in your understanding of how your website performs. Fortunately, a growing category of privacy-first analytics tools offers a compelling alternative: cookieless analytics that captures data for 100% of your visitors without requiring consent. In this guide, we explore why cookieless analytics matters, review the best alternatives available today, examine how they work technically, and show you how to combine them with traditional tools for the most complete picture possible.

Why traditional analytics breaks down under GDPR

Google Analytics: the tool used by an estimated 85% of websites worldwide: relies on cookies to identify and track users across sessions. When a visitor lands on your site, Google Analytics sets a _ga cookie (and several others) that assigns them a unique client ID. This ID persists across visits, allowing GA to build a picture of returning visitors, session duration, conversion paths and more.

Under GDPR and the ePrivacy Directive, these cookies are classified as non-essential because they are not strictly necessary for the website to function. That means you need explicit, informed, freely-given consent before setting them. If a visitor does not consent: or simply closes the cookie banner without interacting: no cookies can be set and no data is collected.

The practical consequence is a growing "consent gap" in analytics data. Your Google Analytics dashboard shows only the subset of visitors who clicked "Accept." The rest: often your most privacy-conscious, technically sophisticated users: are invisible. This skews every metric: bounce rates, conversion rates, traffic sources and user demographics all become unreliable because they are based on a self-selected sample rather than the full population.

Several DPA rulings have made this situation even more challenging. In January 2022, the Austrian DSB ruled that the use of Google Analytics violated GDPR because data was transferred to the United States without adequate safeguards. The French CNIL and Italian Garante issued similar decisions shortly afterwards. While the EU-US Data Privacy Framework (adopted July 2023) has eased some transfer concerns, it has not eliminated the consent requirement for analytical cookies.

What makes analytics "cookieless"?

Cookieless analytics tools use a fundamentally different approach to tracking. Instead of setting a persistent cookie to identify returning visitors, they rely on a combination of techniques:

  • Session hashing: The tool creates a temporary hash from non-personal attributes: such as the visitor's IP address (which is then discarded), the date, the user agent string and the website domain. This hash is unique enough to identify a session but cannot be used to track a user across days or websites.
  • No persistent identifiers: Unlike Google Analytics, cookieless tools do not store anything in the visitor's browser. No cookies, no localStorage, no IndexedDB. When the session ends, the connection between the visitor and their data is lost.
  • Server-side processing: Data is processed on the server, not in the browser. This eliminates the need for client-side storage and makes the tool invisible to ad blockers (in most cases).
  • IP anonymisation: Most privacy-first tools hash or discard IP addresses before storing any data, ensuring that no personal data is retained.

Because no personal data is stored on the user's device and no persistent identifiers are created, these tools generally do not require consent under GDPR. Several European DPAs have confirmed this interpretation: the French CNIL, for example, has published a list of analytics tools that can be used without consent, provided they meet specific criteria regarding data minimisation and purpose limitation.

The best alternatives to Google Analytics

1. Plausible Analytics

Plausible is an EU-based analytics tool (headquartered in Estonia) that has quickly become one of the most popular privacy-first alternatives. It is entirely open source, lightweight (under 1 KB of JavaScript) and designed to provide essential metrics without any cookies or personal data collection.

  • Fully hosted within the EU (Hetzner data centres in Germany and Finland)
  • No cookies, no localStorage, no fingerprinting
  • Clean, intuitive dashboard that loads instantly
  • Goal conversions, custom events and UTM parameter tracking
  • Revenue tracking for e-commerce
  • From EUR 9/month (based on page views)

Plausible is listed on the CNIL's recommended tools and has been independently reviewed by several privacy experts. Its simplicity is both its strength and its limitation: if you need advanced segmentation, cohort analysis or raw data exports, you may find it insufficient on its own.

2. Fathom Analytics

Fathom is a Canadian company with EU data isolation (all EU visitor data is processed and stored exclusively in Frankfurt, Germany). It takes a similar approach to Plausible: no cookies, no personal data, no consent required: but offers a slightly different feature set.

  • Privacy-first architecture with "intelligent routing" that keeps EU data in the EU
  • No cookies, no consent banner required for analytics
  • Custom events, UTM tracking and API access
  • Email reports and uptime monitoring
  • From USD 14/month

Fathom has a strong reputation among indie developers and small businesses. Its dashboard is clean and fast, and the company is transparent about its data processing practices. One notable feature is its ability to bypass most ad blockers because it serves the tracking script from your own domain via a CNAME setup.

3. Matomo

Matomo (formerly Piwik) is the most feature-rich privacy-first analytics platform available. Unlike Plausible and Fathom, Matomo can be self-hosted, giving you complete control over your data. It also offers a cookieless tracking mode that can be enabled in the configuration.

  • Open-source with a large community and plugin ecosystem
  • Self-hosted option (free) or cloud-hosted (from EUR 19/month)
  • Cookieless mode available (hashed sessions without persistent identifiers)
  • Advanced features: heatmaps, session recordings, A/B testing, funnels
  • Full data ownership when self-hosted
  • CNIL-approved when configured correctly

The trade-off with Matomo is complexity. Setting up a self-hosted instance requires server administration knowledge, and even the cloud version has a steeper learning curve than Plausible or Fathom. However, for organisations that need a full-featured analytics platform with privacy compliance built in, Matomo is hard to beat.

4. Simple Analytics

True to its name, Simple Analytics takes minimalism to the extreme. It collects the bare essentials: page views, referrers, device types, countries: and nothing more. There is no concept of "users" or "sessions" in the traditional sense.

  • 100% cookie-free, no personal data collected
  • GDPR, CCPA and PECR compliant without a consent banner
  • Data stored in the Netherlands
  • AI-powered insights and goal tracking
  • Tweet and blog post performance tracking
  • From USD 9/month

5. Pirsch Analytics

Pirsch is a German-made, privacy-friendly analytics tool that processes all data within the EU. It offers a server-side tracking option that makes it fully invisible to ad blockers.

  • German company, data processed and stored in Germany
  • Server-side and client-side tracking options
  • No cookies, GDPR compliant without consent
  • Custom events, conversion goals, UTM parameters
  • From EUR 4/month

With cookieless analytics you can measure 100% of visitors, not just those who consented. This eliminates the "consent gap" that makes traditional analytics unreliable in Europe.

Can you use Google Analytics without cookies?

Google Analytics 4 (GA4) introduced a feature called "cookieless pings" (also known as "consent mode modelling") that attempts to estimate user behaviour when cookies are not available. When Google Consent Mode v2 is implemented and a user declines consent, GA4 sends "cookieless pings": limited data signals that do not include cookies or user identifiers. Google then uses machine learning to model the missing data and fill in gaps in your reports.

However, there are important caveats. First, European data protection authorities: including the CNIL and the Austrian DSB: have indicated that even cookieless pings may still constitute data collection that requires consent, because data is transmitted to Google's servers in the process. Second, the modelled data is an estimate, not a measurement. Its accuracy depends on having a sufficiently large sample of consenting users (Google recommends at least 1,000 events per day for reliable modelling). Third, the data is still processed by Google, which means data transfer concerns under GDPR may apply.

For these reasons, many privacy-conscious organisations choose to use a dedicated cookieless analytics tool for baseline measurement and keep Google Analytics as an optional layer for deeper analysis: loaded only when the user gives consent.

How to choose the right cookieless analytics tool

When evaluating alternatives, consider the following criteria:

  • Data residency: Where is the data stored and processed? For GDPR compliance, EU hosting is strongly preferred.
  • Feature depth: Do you need just page views and referrers, or do you need custom events, conversion funnels, e-commerce tracking and API access?
  • Ad blocker resistance: Some tools (Fathom, Pirsch) offer CNAME proxying or server-side tracking that bypasses most ad blockers. Others (Plausible, Simple Analytics) are sometimes blocked because their scripts are served from known domains.
  • Self-hosting option: If full data ownership is critical, Matomo and Plausible offer self-hosted versions.
  • Integration with existing tools: Can the analytics tool feed data into your existing dashboards, CRM or reporting tools?
  • Price: Most cookieless tools charge based on monthly page views. Compare pricing at your expected traffic level, not just the entry-level plan.

How to combine cookieless and traditional analytics

The most effective approach for many websites is a hybrid strategy that combines both methods:

  • Layer 1: Cookieless analytics (always on): Install a privacy-first tool like Plausible or Fathom that runs without consent. This gives you reliable baseline metrics for 100% of your traffic: page views, referrers, device types, geographic distribution and basic conversion tracking.
  • Layer 2: Google Analytics (consent-dependent): Keep GA4 for advanced analysis, but load it only after the user grants consent through your cookie banner. Use GA4 for audience segmentation, detailed conversion paths, integration with Google Ads and other features that require persistent user identification.

This hybrid approach gives you the best of both worlds: complete, unbiased traffic data from your cookieless tool and rich behavioural insights from GA4 for the subset of users who consent. You can cross-reference the two data sources to identify and correct for consent bias in your GA4 reports.

Practical implementation tips

Here are some concrete steps to get started with cookieless analytics:

  • Start with a parallel deployment. Run your cookieless tool alongside Google Analytics for at least 30 days before making any decisions. Compare the data to understand how the consent gap affects your current metrics.
  • Set up custom events. Most cookieless tools support custom events (button clicks, form submissions, downloads). Configure these to track the conversions that matter most to your business.
  • Use UTM parameters consistently. Cookieless tools rely on URL parameters for campaign tracking. Ensure all your marketing campaigns use UTM tags so you can attribute traffic correctly.
  • Configure your CMP correctly. If you are using a hybrid approach, ensure your consent management platform (like Consentio) correctly blocks Google Analytics until consent is given while allowing your cookieless tool to run immediately.
  • Review your privacy policy. Even though cookieless tools do not require consent, you should still mention them in your privacy policy for transparency. Explain what data is collected, how it is processed and where it is stored.

With Consentio, managing this hybrid setup is straightforward. Our platform lets you define which scripts require consent and which can run immediately. Your cookieless analytics tool loads with the page, while Google Analytics and other cookie-dependent scripts wait for user consent: all controlled through a simple, visual interface.