Privacy first analytics tools for UK websites: how to choose

What to take away

Cookie rules set the shortlist, not the feature list

The ICO's guidance on direct marketing and privacy and electronic communications treats storing information on a person's device as the regulated act. A tool that sets no cookie and writes nothing to local storage therefore starts from a simpler position.

The Data Protection Act 2018 sits alongside the UK GDPR and applies whenever you process information that can single out a person. An IP address combined with a page view can do that, so a server-side log is not automatically outside the law.

Where those duties split into separate decisions, the privacy measurement UK rules and compliance guide sets out PECR, UK GDPR and advertising approval one at a time.

Four tools UK teams shortlist

Four names come up most often when UK teams shortlist a cookie-free option: Plausible, Fathom, Matomo and Simple Analytics. Check each one against its current documentation before you sign, because hosting, retention and export terms change.

None of these is a measurement strategy. A cookie-free tool tells you what happened on your site; it cannot tell you what would have happened without your advertising.

A staged pilot you can run in two weeks

Data residency, contracts and the exit path

Where data rests decides how much paperwork you need. An EU-hosted tool with a signed data processing agreement is quicker to document than a US service.

US transfers rely on a mechanism such as the UK extension to the EU-US Data Privacy Framework or the International Data Transfer Agreement. Both routes are available, and both add documents to your record.

Retention is the other half of the same question. Ask what happens to your data when the subscription ends, and whether deletion reaches the backups as well as the live database.

For the internal case, the ONS digital economy releases give sector-level context on UK online activity, which is a steadier backdrop than a vendor's growth chart.

Where the four tools strain

Plausible and Fathom deliberately keep reporting narrow, so session replay and deep ecommerce attribution are out of scope. Simple Analytics takes a similarly light approach. Matomo covers more ground but asks for more configuration, and self-hosting moves the compliance work back to you.

The practical split is this: pick a hosted EU tool when you want a short audit trail, and a self-hosted option when control matters more than convenience.

Common questions

Do I need a cookie banner if I use Plausible or Fathom?

If the tool stores nothing on the device and does not single out individuals, consent for that tool is generally not needed. Other cookies, and any direct marketing use of the data, carry their own rules.

Is Google Analytics 4 banned in the UK?

No. GA4 is not prohibited here, but you still have to explain your lawful basis, your retention period and any international transfers. Many UK teams move to an EU-hosted tool to shorten that explanation.

Plausible vs Fathom: which is easier to defend?

Both avoid cookies and both publish EU data options, so the tie usually breaks on the signed terms your legal adviser can actually read. Check hosting and deletion in the current documentation before you sign.

Should I keep GA4 running alongside a cookie-free tool?

Running both during a transition is common and useful for reconciliation, but it means two data flows to document. If you want to know whether the alternative numbers can replace GA4 outright, cookieless attribution in the UK sets out what is and is not recoverable.