TL;DR:
GDPR-compliant analytics means measuring traffic without processing personal data or storing cookies, so no consent banner is required. The tools that qualify are Open Analytics, Plausible, Fathom, Umami and Simple Analytics, all cookieless and privacy-first. Open Analytics leads for teams that also want revenue attribution; the rest trade depth for simplicity.
Under GDPR and the EU's ePrivacy rules, analytics that stores no cookie and processes no personal data does not need consent, no banner, no legal review to launch. That is what "GDPR-compliant analytics" means in practice: not a tool that asks permission well, but one that never needs to ask. The tools below all clear that bar.
What makes analytics GDPR-compliant without consent
- No cookies or device storage: nothing to consent to under ePrivacy.
- No personal data: anonymous, daily-rotating signals instead of persistent identifiers.
- No cross-site profile: nothing to sell to an ad network, nothing to transfer.
- Honours GPC and Do Not Track: opt-out signals respected, not overridden.
The compliant tools
- 01
Open Analytics
That's usOne cookieless script that follows a visitor from first pageview to payment, with the dataset queryable by an AI agent.
Price: From $9/mo for 50,000 events (a pageview or anything you tag), 3-day free trial.
Strengths
- Revenue attributed back to the visit and source that earned it
- Built-in MCP server: ask your analytics in plain English
- Realtime journeys, funnels and Core Web Vitals in one script
- Open source (AGPL) and self-hostable
Trade-offs
- Newer than Plausible or Fathom
- Meters events, so tagged conversions count
- No free plan, only the trial
The simplest compliant dashboard, EU-owned and EU-hosted.
Price: From $9/mo for 10,000 pageviews.
Strengths
- No cookies, no banner
- EU data residency
- Open source
Trade-offs
- No revenue attribution
- Pageview-metered
- No journey
- 03
Fathom
Cookieless and compliant, flat-priced across sites.
Price: From $15/mo, unlimited sites.
Strengths
- No banner
- EU isolation option
- Imports from GA
Trade-offs
- Aggregate-only
- Pageview-metered
- No revenue
- 04
Umami
Compliant and free to self-host in your own region.
Price: Free self-hosted; Cloud from free to $20/mo.
Strengths
- Full data control when self-hosted
- No cookies
- Open source
Trade-offs
- You run it
- No revenue attribution
- Limited importers
The most privacy-maximal: no visitor identifiers at all.
Price: From $20/mo; free 30-day-history plan.
Strengths
- No visitor IDs whatsoever
- EU-hosted
- Free tier
Trade-offs
- Per-user pricing
- Shallow by design
- Pageview-metered
This is general information, not legal advice. Compliance depends on your full setup, other scripts, forms and integrations may still process personal data and need consent. Check with a qualified advisor for your specific case.
Open Analytics is the events-metered, revenue-aware option with an AI-queryable dataset. Try it free for three days.
Start free trialFrequently asked questions
- What is the most GDPR-compliant analytics tool?
- Any cookieless tool that stores no personal data qualifies, Open Analytics, Plausible, Fathom, Umami and Simple Analytics all need no consent banner. Simple Analytics is the most privacy-maximal (no visitor IDs at all); Open Analytics leads if you also want revenue attribution without giving up compliance.
- Does GDPR-compliant analytics need a cookie banner?
- No, that is the point. Because these tools set no cookie and process no personal data, they fall outside the consent requirement, so no banner is needed. If other parts of your site still set cookies, those may need consent, but the analytics itself does not.
- Is Google Analytics GDPR compliant?
- Not by default: GA4 sets cookies and generally needs consent, and several EU regulators have raised data-transfer concerns. It can be configured toward compliance, but a cookieless tool removes the question entirely. See our dedicated explainer on whether Google Analytics is GDPR compliant.