Analytics Without Google Analytics: A Privacy-First Setup

By the BMaiKR team · Updated 2026-10-10

This guide is for site owners who want useful traffic numbers with less personal data. It compares three tools on verifiable facts and shows how to set one up. It is not legal advice.

What does privacy-first analytics mean?

• No tracking of the same person across different websites.
• No cookies or other identifiers stored on the visitor's device where possible.
• Raw IP addresses not stored.
• Data kept on infrastructure you choose, ideally in the EU.

Three options compared

Check each project's repository for its current license and features before you choose.

Do you still need a consent banner?

The answer depends on the rules in your country. Cookie rules come from the ePrivacy Directive and national laws, while GDPR covers the personal data itself.

France's data protection authority, the CNIL, published conditions under which audience measurement can be exempt from consent. Its 2020 guidance lists these conditions:

• Users are informed and can object.
• Use is limited to audience measurement and A/B testing.
• Data is not cross-checked with other processing or other sites.
• The tracker is limited to a single site or app publisher.
• The last byte of the IP address is truncated.
• Tracker lifetime is capped at 13 months.

The CNIL notes that its page relates to the ePrivacy Directive and may vary by country, and that most large audience-measurement offerings fall outside the exemption whatever their configuration. In Germany, § 25 TDDDG requires consent for storing or reading information on a device unless an exception applies, such as storage that is strictly necessary for a service the user explicitly asked for. Ask your data protection officer how that applies to your setup.

Set it up in six steps

1. Choose a tool and a hosting option. For control over data location, self-host on an EU server or choose an EU-hosted service.
2. Install the tracking script and confirm the domain list.
3. Disable cookies if your tool has the option, and test in a private window.
4. Track outbound clicks to your contact or proposal page as events.
5. Tag links from other properties with lowercase UTM parameters such as utm_source, utm_medium and utm_campaign. Never put personal data in them.
6. Connect Google Search Console and Bing Webmaster Tools for search data, and describe the setup in your privacy policy.

If you keep Google Analytics

You then need to handle consent and the transfer of data to the United States. On 3 September 2025 the EU General Court dismissed a challenge to the EU-US Data Privacy Framework, but commentators describe the ruling as provisional and it can be appealed. Ask your legal advisor before relying on it.

Common mistakes

• Assuming cookieless always means no consent is needed.
• Self-hosting without updates or backups.
• Putting email addresses or names into event properties.
• Forgetting to mention analytics in the privacy policy.