Privacy first measurement: four providers on a non-ranked England shortlist

What to take away

Four products carry enough published detail to shortlist in England: Matomo, Plausible Analytics, Fathom Analytics and Piwik PRO. None is endorsed.
Matomo and Piwik PRO suit buyers needing control of fields, hosting region and retention. Plausible and Fathom suit buyers accepting a fixed event model with documented exports.
Your numerator, denominator, period and exclusions decide suitability, not a vendor page.
Pricing is quote based once seats, event volume, retention and support are counted.
A cookie-free claim does not remove PECR or UK GDPR duties for added scripts or identifiers.

The four on deployment, export and configuration

The four on deployment

Deployment

Matomo: Cloud or self-hosted
Plausible: Hosted, self-hosted edition
Fathom: Hosted
Piwik PRO: Cloud with region choice

Export route

Matomo: Database, API, scheduled reports
Plausible: Dashboard CSV and API, plan dependent
Fathom: CSV export
Piwik PRO: API and warehouse routes

Configuration dependency

Matomo: High: optional features change the data set
Plausible: Low to moderate
Fathom: Low: fixed event model
Piwik PRO: Moderate to high: tenant and module choices

Judgement

Matomo: Shortlist for field control
Plausible: Shortlist for aggregate reporting
Fathom: Shortlist for a narrow data path
Piwik PRO: Shortlist for documented controls

Supplier pages cited here were read on 5 September 2026. Export routes only count if the numbers reconcile, so test them before shortlisting. No provider supplied access, funding or gifts, and there are no affiliate links.

Provider notes and shortlist judgements

Matomo

Matomo's data collection page lists default and optional fields. Optional features change the data set, so the deployment you buy is the deployment you test. Ask which route is offered, which features will run, and what identifiers enter URLs or custom dimensions. A field inventory turns that page into a testable scope.

Matomo buyer checks

Ask which deployment is offered
Ask which optional features will run
Ask what identifiers enter URLs
Reproduce acceptance, refusal and withdrawal cases
Verify export and deletion against contract

Shortlist if you need field-level control and can staff hosting. Hold if nobody owns updates and deletion.

Plausible Analytics

Plausible documents dashboard CSV, API and other access routes, with plan and format differences. Test event definitions, filters, time zones, imported data and full-history extraction. Request security and legal documents separately.

Shortlist if aggregate reporting and documented exports fit your measure. Hold if you need raw event replay.

Fathom Analytics

Fathom sets out a routing, hashing and aggregation sequence a buyer can map and test. Request the current agreement, subprocessors and the region-specific data path. Reconcile exported totals, then read the export evidence comparison to judge two suppliers on the same output.

Shortlist if a narrow, fixed data path is acceptable. Hold if custom dimensions matter.

Piwik PRO

Piwik PRO publishes a privacy and security overview covering hosting, controls and product approach. Treat each badge within its precise scope. Request evidence for the contracted region, tenant separation, access, retention, export and deletion.

Shortlist if you can review an assurance pack. Hold if region or tenant evidence is missing.

Example: reproducing one measure with Plausible

The steps below use a buyer's own numbers, not vendor figures.

Reproducing one measure

Define the numerator as completed checkout events, and the denominator as sessions on the checkout path.
Fix the period at four full weeks, Monday to Sunday, Europe/London time.
List exclusionsinternal IPs, staff devices, bot traffic and test orders.
Rebuild the figure from the CSV export and compare it with the dashboard.
Record the gap. If it cannot be closed, stop the trial.

Consent and cookie-free tools

A tool that sets no cookies still needs review. PECR's storage and access rules reach beyond cookies to similar technologies. The ICO's guidance on storage and access technologies tests the technology and its purpose, not the label. Server-side scripts and custom properties may need consent and a lawful basis under the UK GDPR.

A banner is not a compliance answer. Map what fires before a person chooses, then decide which lawful basis applies.

Cost and licensing signals

Some of the four publish list prices, but seats, event volume, retention and support move the real number. Confirm pricing in writing. Self-hosting trades licence cost for infrastructure and staff time; cloud tiers bundle hosting but add overage risk. Read the contract questions before signing, since exit terms decide the real cost.

Shortlist verdict

The title's "best providers" framing is refused on purpose. There is no defensible universal winner, and nothing here is ranked. Move a candidate to a restricted trial only after privacy, PECR, security, accessibility, measurement and contract reviewers approve the test plan.

Move to restricted trial?

Do privacy, PECR, security, accessibility, measurement and contract reviewers approve the test plan?

Yes

Move candidate to a restricted trial

Hold the candidate

Hold if a required data flow is unclear, the contract conflicts with the intended role, or a full export cannot be reconciled. Recheck every cited supplier page on the procurement decision date.

Common questions

Which of the four should an England buyer trial first?

Start with the provider whose deployment matches your control needs. Matomo or Piwik PRO if you need field and region control. Plausible or Fathom if a fixed event model fits.

Do cookie-free tools remove consent duties?

No. PECR covers storage and access beyond cookies, and the ICO examines the technology and its purpose. Added scripts and identifiers can still need consent and a lawful basis.

What should end a trial?

A numerator that cannot be rebuilt from an export, a data flow the supplier will not document, or a contract that conflicts with the intended role.