Five measurement tools as architecture candidates, judged on first-party evidence only

What to take away

Five products fit an architecture shortlist on first-party evidence: Fathom Analytics, Google Analytics 4, Matomo, Piwik PRO Analytics Suite and Plausible Analytics.
No record among them proves England-specific availability, and none proves PECR or UK GDPR compliance for your configuration.
Compare collection method, hosting control, export route and deletion evidence before price.
No vendor reviewed publishes a GBP list price, so budget from sterling quotes.
Give every shortlisted tool the same synthetic events and refusal states.

The five candidates on one page

Inclusion required a live first-party page describing collection or exposure of measurement data; the order is alphabetical, not a ranking.

[figure 1]

Inclusion and evidence criteria

Named product with live first-party page
Collection method and hosting control
Reporting scope and export route
Deletion evidence and procurement questions
Buyer scenarioEngland; records global or European
No prices, ratings, rankings or untested features

Collection

Fathom Analytics: First-party browser request; temporary IP and user agent, daily salt rotation
Google Analytics 4: Tag with separate consent types for analytics and advertising storage
Matomo: Configurable fields: IP address, URL, referrer, screen resolution
Piwik PRO: Tag plus integrated consent manager
Plausible Analytics: Script, aggregate by default

Hosting control

Fathom Analytics: Vendor cloud; EU routing for EU visitors
Google Analytics 4: Vendor cloud with region settings
Matomo: Cloud or self-hosted On-Premise
Piwik PRO: Cloud location choice, dedicated databases
Plausible Analytics: Vendor cloud with EU option

Export route

Fathom Analytics: Plan-based dashboard CSV
Google Analytics 4: Interface; BigQuery on some properties
Matomo: API and database access when self-hosted
Piwik PRO: API and scheduled exports
Plausible Analytics: CSV, full export, Stats API, Enterprise raw events

Deletion evidence to request

Fathom Analytics: Retention window, backup deletion
Google Analytics 4: Retention, modelled values, deletion boundaries
Matomo: Patching, backups, access logs
Piwik PRO: Erasure scope, certification coverage
Plausible Analytics: Raw-event deletion, plan limits

Consent and storage access are governed by the Privacy and Electronic Communications Regulations 2003, and processing needs a lawful basis under the UK GDPR. Those rules bite whatever you deploy.

Decide which output the business needs before shortlisting. Attribution methods and what each output really means shows how last-click, modelled and incrementality results diverge.

Fathom Analytics

Fathom's first-party data page describes the browser request, temporary processing of IP address and user agent, daily salt rotation and EU routing for EU visitors. Those are vendor statements, so inspect the contract.

Disqualifier for an England-based buyer: a rule requiring confirmed English hosting, or raw event-level export, is not met by anything published here.

Google Analytics 4

Google's consent-type documentation separates analytics storage, advertising storage, advertising user data and personalisation settings. It states that the banner illustration is not legal guidance.

Disqualifier: if the tag cannot separate advertising storage from analytics storage in every consent state, the property fails the collection test.

Matomo

Matomo's tracked-data FAQ lists default items including IP address, page URL, referrer, screen resolution and approximate location, alongside optional collection. Other pages separate Cloud from On-Premise.

Disqualifier: self-hosting moves patching, backup deletion and user access to the buyer, so a team without that capacity should skip it.

Piwik PRO Analytics Suite

Piwik PRO's privacy and security page describes cloud-location choices, dedicated databases, access controls, consent-management functions and supplier certifications. Treat each as a claim to inspect.

Disqualifier: if consent signals do not govern every relevant tag in the container, the integrated consent controls lose their point.

Plausible Analytics

Plausible's data-access documentation separates dashboard CSV, full export, Stats API and Enterprise raw-event exports. It also labels some warehouse connectors as community maintained, so seven contract questions for a measurement supplier covers the support and exit terms to fix before signing.

Disqualifier: aggregate-only reporting fails a buyer who needs per-user paths, and community connectors carry no vendor support commitment.

Running one shared trial

The ICO's storage and access guidance states that first-party terminology does not settle the PECR question. A shared trial is the only fair comparison.

[figure 2]

Turn the list into a trial

Give shortlisted products same synthetic events
Include identical refusal states
Rebuild one report outside each tool
Inspect network requests
Request written answers for missing items
Get qualified technical, privacy and commercial review

Define the report and the decision it supports.
Load identical synthetic events into each tool, including a purchase, a duplicate and a bounce.
Repeat every step with consent refused, then with consent accepted.
Rebuild one report outside each tool from its export.
Inspect network requests and log what fires before consent.
Request written answers on contract, transfer, security and accessibility.

Price comes last. Ask for a sterling quote naming seats, event volume, raw-event or API access and overage.

Before you act

Agree the evidence list before opening a trial account.
Run identical synthetic events and refusal states in every tool.
Rebuild one report outside each tool from an export.
Inspect network requests in each consent state.
Collect written answers on contract, transfer, security and accessibility.
Take qualified technical, privacy and commercial review before signature.

Each item belongs in a written record; the buyer checklist that keeps PECR, security and accessibility in separate gates shows how to hold them apart.

Common questions

What evidence should I request from each vendor?

Processor terms, the full sub-processor list, hosting region, retention windows, deletion across backups, security certification scope and accessibility test results. Ask in writing and file the replies with the trial notes.

How do I compare quotes without published GBP prices?

Ask every supplier for a sterling quote covering seats, event volume, raw-event or API access and overage. Compare those figures only after the trial and the contract answers arrive.

What would disqualify a tool for an England-based buyer?

Unconfirmed hosting or transfer route, no deletion evidence for backups, no accessibility testing, or consent signals that leave some tags ungoverned.