How to choose privacy first measurement tools and providers

Privacy first measurement tools and providers should be chosen by testing a defined data flow against a real decision. A privacy label, short script or server location may narrow questions. None proves that an England deployment meets PECR, UK GDPR, security, accessibility or reporting needs.

This guide is based on desk research completed on 5 September 2026; it sets out tests the buyer runs against each candidate rather than a result handed over by a supplier. The editorial team has no stated commercial relationship with any product or provider named here, and the examples are illustrative rather than endorsed. Any 2027 purchase needs fresh checks because product controls, sub-processors, guidance and contracts can change.

What to take away

Decide whether the gap is software, delivery or governance

A team that cannot agree what a conversion means will not fix the problem by buying another dashboard. Start with the decision, population, outcome and minimum evidence. Then trace every event from the person or system that creates it to the report used by the decision-maker.

Mark the break. The gap may be collection, permission handling, identity matching, calculation, reconciliation, interpretation or ownership. That diagnosis determines whether the organisation needs a product, an implementation specialist, an independent audit, managed monitoring or internal training.

Write exclusions at the same time. For example, decline cross-site profiling, person-level exports, advertising activation or a specific international transfer if it is not necessary for the decision. Exclusions prevent a broad demonstration from quietly becoming the requirement.

The ICO's data protection by design guidance places privacy work at design stage and throughout the lifecycle. It is a reason to involve the accountable data owner before the shortlist, not after contract signature.

Describe the collection architecture without brand language

Ask each candidate to draw what happens on a granted, refused and withdrawn choice. The diagram should show device operations, network requests, identifiers, transformations, storage, recipients, models, reports and deletion routes.

The ICO's final storage and access technologies guidance covers cookies, pixels, scripts, tags, web storage and fingerprinting. It explains why labels such as first party, third party, client side and server side do not decide whether PECR applies. Product marketing therefore belongs in the evidence queue, not the approval column.

The two consent frameworks most buyers of advertising-connected measurement will be asked about are Google Consent Mode (v2) and IAB Europe's Transparency and Consent Framework (TCF). Both carry signals about a person's choice to tags; neither is a consent mechanism in itself, and default-denied signals do not create a lawful basis under PECR for storage or access that continues. Ask each candidate which signals it reads and writes, what it does when no signal arrives, and how a withdrawal reaches data already held.

A hosted aggregate service, self-hosted platform, advertising-suite measurement product and custom warehouse can observe different units and create different work for the buyer. Compare them only after defining required events, dimensions, joins, freshness and report outputs. A feature is useful when it answers the stated decision within the acceptable data boundary.

Named examples make the categories concrete. Matomo can be self-hosted or bought as Matomo Cloud; Plausible Analytics, Fathom Analytics and Simple Analytics are hosted, cookie-free aggregate services; Umami is an open-source option a team can host itself. Google Analytics 4 and Adobe Analytics sit in the advertising-suite group, where consent signals, identity features and activation are part of the product rather than an add-on. These names are starting points for the evidence process, not a ranking.

Require six evidence packs

1. Role and instruction record

Ask who decides purposes and essential means, whether the provider has any independent use, and which parties receive information. The ICO's controller and processor guidance makes status depend on real responsibilities. A contract label or vendor assertion cannot determine it.

Where a processor relationship exists, obtain the applicable terms and map them to the service. The ICO's contracts guidance covers instructions, confidentiality, security, sub-processors, assistance, end-of-contract handling and audits. It expressly does not replace professional commercial-contract advice.

2. Location and transfer record

List hosting, backup, support access, telemetry, content delivery and onward-processing locations. "Hosted in Europe" is not enough if administrators or sub-processors elsewhere can gain access. The ICO's January 2026 international-transfers guide sets out a three-step test and points to other UK GDPR duties that still apply. Where a restricted transfer needs a written safeguard, the UK instruments are the ICO's International Data Transfer Agreement (IDTA) and the Addendum that extends the EU standard contractual clauses to UK law, used with a transfer risk assessment.

Require notification of location or sub-processor changes and define the buyer's response. A future transfer assessment must use the arrangement that will actually operate. The record belongs inside the Article 30 record of processing activities that UK GDPR requires most controllers and processors to keep, and it must survive a change of supplier.

3. Security and continuity record

Request current assurance evidence, its scope, exceptions, testing date and remediation status. Ask about identity administration, least privilege, logs, encryption, vulnerability handling, incidents, backups and recovery tests. ISO/IEC 27001 for information security management, a SOC 2 report against the AICPA trust services criteria, and the NCSC-backed Cyber Essentials or Cyber Essentials Plus schemes are the assurance schemes UK buyers quote most often; each has a scope and exclusions, and a certificate for one service line says nothing about another. For penetration testing, ask for a CREST-accredited provider and the date of the most recent test.

The National Cyber Security Centre's SaaS security guidance says services change quickly and describes the questions customers can use to gain confidence. It is not an endorsement of any supplier. Match the depth of evidence to the harm from loss, alteration or unavailability.

4. Accessibility record

Buyers need to know whether people using assistive technology can operate dashboards, filters, reports, consent interfaces and support routes. Ask for an accessibility statement, the test method, the standard tested against and known failures. WCAG 2.2 level AA is the level most UK buyers and suppliers quote; a statement that says only "accessible" or "WCAG compliant" is not evidence. Include keyboard-only use, focus order, labels, contrast, chart alternatives and exported-report structure in the trial.

GOV.UK guidance on making technology accessible and inclusive is written for government technology. Its procurement questions are still useful prompts for other buyers, but its public-sector duties should not be presented as universal private-sector rules. The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 require public sector bodies in scope to meet WCAG and publish an accessibility statement; for a private-sector buyer that is a benchmark, not a duty. A supplier's statement needs buyer-side verification against actual users and workflows.

5. Data access and exit record

Specify what can be exported, by whom, in which format and at what level of detail. Test whether definitions, configuration, audit history and consent-state records travel with the figures. A CSV of final totals may not reproduce the report or support migration.

Set deletion triggers for test data, expired purposes, user requests and contract exit. Ask how deletion reaches replicas, backups, derived tables and sub-processors, along with any lawful retention exception. The answer should name evidence the buyer receives after completion.

6. Measurement-quality record

Define event acceptance, bot treatment, session rules, deduplication, attribution, late data, timezone, modelling and revision. Require the supplier to distinguish direct observation from estimation. Build a small synthetic event set with known expected outputs, including duplicates, missing values, refusal and withdrawal.

Do not ask which candidate has the "most accurate" analytics without a reference truth and shared test. Reconcile each result to the same input. Record mismatches rather than hiding them in an overall score.

Run a two-stage evidence process

The first stage is documentary. Send identical questions and require links or files, owners and dates. Mark claims as verified, partly evidenced, asserted or unanswered. Do not award points merely because a candidate supplied more pages.

The second stage is a contained trial. Use synthetic or appropriately controlled data. Test installation, consent states, permissions, accessibility, export, deletion, failure handling and reconciliation. Keep the trial outside production until privacy, security and technical owners approve its boundary.

A useful scoring sheet separates pass or fail gates from preferences. Legal authority, unacceptable transfer exposure, missing deletion capability or an inaccessible core workflow may be an exclusion. Dashboard layout or optional integrations can be weighted preferences. Leave weights blank until stakeholders agree them; invented precision will not improve the decision.

Compare providers on the same service outcome

A consultancy, small specialist and managed-service team may publish very different scopes. Give each the same problem statement and deliverables. Require names for the people doing the work, assumptions about client effort, evidence produced, access requested, subcontractors, change control and handover.

The same scoring applies to whoever supplies. Vendors such as Matomo, Plausible Analytics, Fathom Analytics and Simple Analytics sell hosted plans and support alongside their software, while agencies and independent privacy consultants sell implementation, migration and audit work around them. A licence, a managed service and a project are not comparable line by line, so ask what each will do, who will do it, and what the buyer must provide.

References and case studies are supplier-selected material. Verify the engagement type and ask the referee about outputs relevant to the current need. Do not convert a logo, partner badge or testimonial into a ranking.

Commercial comparison needs the same boundary. Request separate figures for licences, implementation, migration, support, training, storage or query growth, specialist reviews and exit assistance, and use the buyer's own volumes and staff assumptions. No price, licence fee or benchmark cost is quoted here: a valid figure depends on events, retention, support terms and the buyer's own effort, and a vendor's public rate card still has to be modelled. A quoted total that omits internal administration or a dependent cloud service is not yet comparable.

Check the legal entity separately from its trading name. Companies House provides the official company-information search, while warning that it does not verify the accuracy of filed information. It is not the only register to check: a controller that processes personal data must normally pay the ICO's annual data protection fee and appear in the ICO register of fee payers unless an exemption applies. Neither register is proof of competence, solvency or privacy compliance.

Plan implementation before choosing the winner

The selected option must fit an owned change plan. Name the current baseline, the migration unit, parallel-run period, rollback trigger and final authority. Preserve historical definitions so a change in tooling is not reported as a change in customer behaviour.

Give administrators individual accounts and remove trial access on schedule. Record production configuration as code or controlled documentation where possible. Monitor tags, schemas, sub-processors and report definitions after launch. A quarterly review date is not enough if the supplier announces a material change tomorrow.

Exit should be rehearsed while use remains. Export a representative dataset, reproduce one decision report outside the product and test deletion of the trial workspace. If the team cannot do those things before commitment, the unresolved dependency belongs in the approval record.

Make the decision auditable

The final paper should include the need, exclusions, candidate set, research date, evidence status, hands-on tests, conflicts, legal and security reviews, accessibility findings, total commercial assumptions, failed criteria and reason for selection. Preserve dissent and unknowns.

Approval should identify exactly which version, hosting route and service arrangement was accepted. It should state the conditions that would reopen the choice, such as a new purpose, processor role, location, sub-processor, model, pricing basis or missing control. No selection document should promise that the tool or provider will remain compliant in 2027.

Before you act

Common questions

What should a team do before shortlisting measurement suppliers?

Start with the decision, population, outcome and minimum evidence. Trace every event from its creator to the report used by the decision-maker. Mark where the break occurs, whether collection, permission handling, identity matching, calculation, reconciliation, interpretation or ownership. That diagnosis determines whether the organisation needs a product, specialist, audit, monitoring or training.

Why is hosted in Europe not sufficient for a transfer record?

Administrators or sub-processors elsewhere may still gain access to data. The record should list hosting, backup, support access, telemetry, content delivery and onward-processing locations. Require notification of location or sub-processor changes and define the buyer's response. A future transfer assessment must use the arrangement that will actually operate, not the one described at procurement.

How should buyers compare providers fairly?

Give each candidate the same problem statement and deliverables. Require names of people doing the work, assumptions about client effort, evidence produced, access requested, subcontractors, change control and handover. References and case studies are supplier-selected material, so verify the engagement type and ask referees about outputs relevant to the current need rather than treating logos as rankings.