Se rendre au contenu

Google Analytics Alternatives: GDPR-Compliant Tools in 2026

Matomo, Plausible, Umami: which Google Analytics alternative lets you measure your audience while staying compliant with GDPR and CNIL rules?

Google Analytics Alternatives: GDPR-Compliant Tools in 2026

Website traffic analytics dashboard displayed on a laptop

Matomo, Plausible and Umami are the three serious alternatives to Google Analytics. They measure your site's traffic without sending your visitors' data to Google. If you configure them according to the CNIL's rules, you can sometimes skip collecting consent for audience measurement. The right choice mostly depends on two questions: who hosts the data, and how much detail do you actually need?

Key takeaways:

  • Since the adequacy decision of July 10, 2023, data can flow freely to US companies certified under the Data Privacy Framework, but the decision is still subject to regular reviews.
  • To be exempt from consent, audience measurement trackers must only produce anonymous statistics, exclusively on behalf of the site publisher, with no cross-referencing with other processing.
  • According to the CNIL, most of the major audience measurement offerings fall outside the scope of the exemption, however they are configured.
  • Matomo offers a CNIL mode under Administration > Privacy > Compliance, but compliance can't be confirmed until an opt-out is in place.
  • An open source tool hosted on your own server lets you decide where your statistics live and how long they are kept.
Yundera
Stay in control of your data
Yundera offers a managed private server in France, with your apps and data under your control, no technical skills required.

Table of Contents

Why look for a Google Analytics alternative in 2026?

Small businesses and freelancers usually look for a Google Analytics alternative for four reasons: to depend less on a US provider, to stop losing data to the consent banner, to replace a tool that has become too heavy for a small site, and to stay in control of their traffic data. None of these reasons is purely legal, and each one has a real cost.

  • Dependence on a US provider: your statistics are processed on Google's infrastructure, under Google's terms. The CNIL advises users of measurement tools to watch out for any data transfers outside the European Union.
  • Data lost to the banner: a tool that doesn't meet the exemption conditions requires consent, so every refusal shrinks your numbers. The CNIL notes that some offerings fall outside the scope of the exemption, especially when the provider reuses the data for its own purposes.
  • GA4 complexity: for a brochure site or a blog, a handful of metrics is enough (page views, traffic sources, simple conversions). GA4's event-based setup is often overkill.
  • Data ownership: you rarely get to decide where your statistics are stored, how long they are kept, or in what format you can export them.

Pro tip: before choosing a tool, write down the three or four metrics you actually check every month. That list alone often rules out half the options.

Yes, using Google Analytics can be legal in France under the Data Privacy Framework, but only under certain conditions, and the matter isn't permanently settled. The transfer framework changed in 2023, while the consent rules still apply.

  • Free transfers to certified entities: since the adequacy decision adopted on July 10, 2023, you can transfer data to a certified US company without additional safeguards.
  • Verification is up to you: you must check that the recipient appears on the list published by the US Department of Commerce. A transfer to an entity not on that list can't rely on the adequacy decision.
  • A framework under review: a first review was scheduled one year after it took effect, and subsequent reviews must take place at least every four years. The decision remains in force until it is amended, replaced or repealed.
  • Non-certified recipients: the CNIL considers proxying a viable solution, while pointing out that changing only how the IP address is handled isn't enough. Among other things, the IP address must not be sent to the tool's servers and the external referrer must be removed. The CNIL acknowledges that these measures can be costly and complex.

Lawful transfers don't settle the tracker question, though: a tool that falls outside the exemption still requires your visitors' consent.

Pro tip: keep a dated record of when you checked the recipient's certification. If the framework is ever challenged, you'll know right away which tools to reassess.

Can you measure your audience without a cookie banner?

Yes, you can measure your audience without a cookie banner if your tool meets the exemption conditions set by the CNIL. These conditions cover both how the tool is configured and how you use the data.

According to the CNIL page updated on July 4, 2025, trackers must meet the following requirements:

  • Single purpose: they are used only to produce anonymous statistics.
  • For the publisher only: the data is processed exclusively on behalf of the site publisher, not the tool provider.
  • No cross-referencing: the data must not be combined with other processing, such as a CRM or an ad network.
  • Limited lifespans: the CNIL recommends limiting tracker lifespan to around thirteen months and keeping collected information for no more than twenty-five months.

The CNIL no longer publishes a list of exempt tools. Instead, it offers providers a self-assessment tool to check whether their solution can be configured to meet these conditions. So it's up to you to check what your provider claims. The CNIL also notes that some offerings fall outside the scope of the exemption, especially when the provider reuses the data for its own purposes.

Pro tip: a "cookieless" tool doesn't exempt you from this check, because the CNIL's rules cover cookies and other trackers alike. Verify the purpose, the absence of cross-referencing and the retention periods before you remove your banner.

What are the best alternatives to Google Analytics?

The three most frequently cited Google Analytics alternatives are Matomo, Plausible and Umami. Matomo is the most comprehensive, Plausible the easiest to adopt, and Umami the lightest to self-host. Here's how they compare on the criteria that matter to small businesses and freelancers.

  • Matomo: available in Cloud and On-Premise versions. Based on its self-assessment, the vendor states that both versions meet the CNIL criteria when properly configured. Matomo uses trackers, limited to 13 months by default in CNIL mode. Its reports are detailed, and it offers advanced features such as A/B testing. It suits multi-site businesses and e-commerce sites.
  • Plausible: according to its data policy, it uses no cookies and no persistent identifier, and visitor data is stored in the EU. The dashboard fits on a single page. It suits brochure sites, blogs and freelancers.
  • Umami: an open source platform that works without cookies or cross-site tracking. You can use it as a cloud service or self-host it. It suits small sites and teams that want to keep their statistics on their own infrastructure.

These summaries are no substitute for your own checks: compliance always depends on your configuration. The following sections cover how to set up Matomo and what data Plausible and Umami actually collect.

Pro tip: if you can't decide, run two tools side by side on the same site for a month. Compare the numbers you get and the time you spend reading them.

How do you configure Matomo for the CNIL consent exemption?

To configure Matomo for the CNIL consent exemption, enable its compliance mode in the admin panel, site by site, then set up an opt-out. Without an opt-out, compliance can't be confirmed. Here are the steps described in Matomo's official documentation.

Chart of website traffic statistics

  1. Log in: sign in to Matomo with a super user account.
  2. Compliance menu: go to Administration > Privacy > Compliance.
  3. Select the site: pick the site you want to make compliant from the drop-down list. Settings apply site by site.
  4. Enable: check Enforce compliance where possible, then click Save.
  5. Opt-out: give your visitors a way to refuse tracking, for example in your privacy policy.

CNIL mode changes several settings, and some of the effects can't be undone:

  • Retention: the data retention period is automatically set to 759 days, or about twenty-five months.
  • Trackers: their lifespan is limited to 13 months by default.
  • A/B tests: enabling the mode permanently deletes existing experiments.
  • Scope: it is strictly limited to purposes such as performance measurement and analysis of the content viewed. Marketing measurement, such as ad campaign performance, is excluded.

Pro tip: export your A/B test results before enabling CNIL mode. If you track ad campaigns, keep them in a separate tool that requires consent.

Plausible or Umami: what data is actually collected?

Plausible and Umami both collect traffic statistics without cookies, but they handle data differently. Plausible is an EU-hosted service that follows specific collection rules. Umami can be self-hosted, which lets you decide where your data lives.

  • Plausible, no cookies: according to its data policy, Plausible uses no cookies and no persistent identifier. The daily identifier is a hash computed from a salt, the domain, the IP address and the User-Agent. The salt is rotated and deleted every 24 hours.
  • Plausible, stored data: neither the IP address nor the raw User-Agent is kept. For URLs, only the hostname and path are retained, and query parameters are stripped, except for supported campaign and referrer parameters. Plausible does, however, keep event and session records.
  • Plausible, location: visitor data is stored in the EU, on infrastructure owned by European companies. The company is registered in Estonia and uses subcontractors where necessary.
  • Umami, open source: Umami's documentation states that it works without cookies, without cross-site tracking and without automatically collecting personal data. You can use its cloud service or install it on your own infrastructure.
  • Umami, custom data: any data you choose to send, such as a distinct identifier or event properties, remains your responsibility.

Pro tip: never send an email address or customer ID in a custom event. You'd be reintroducing personal data into a tool you chose precisely to avoid it.

Self-host your analytics or use a European SaaS?

A European SaaS is the right fit if you want working statistics within minutes. Self-hosting free software is the right fit if you want to decide for yourself where your data is stored, how long it's kept and how it's exported. Either way, these decisions will shape the next several years.

  • European SaaS: speed: you add a script to your site and the dashboard starts filling up. There's no server and no updates to manage.
  • European SaaS: dependence: you depend on the provider's terms, its subcontractors and its pricing. Check its contract to make sure it doesn't reuse the data for its own purposes: according to the CNIL, such reuse takes the offering outside the scope of the exemption.
  • Self-hosting: control: a tool like Umami can run on your own infrastructure. You choose where the data lives, how long you keep it and what format you export it in. Since no third party receives your statistics, the risk of a provider reusing them disappears.
  • Self-hosting: maintenance: you need a server, security updates, backups and an HTTPS certificate. For a small organization without a technical team, this workload is the real deciding factor.

Whichever model you choose, the exemption always depends on your configuration: purpose, no cross-referencing, and retention periods.

Pro tip: before signing up with a SaaS, test a full export of your data. If you can't get your history back in an open format, you're recreating the very dependence you were trying to escape.

How do you migrate from Google Analytics without losing your bearings?

To migrate without losing your bearings, first export your Google Analytics history, run both tools side by side for a few weeks, then remove the Google tag. The goal is to understand the differences between the two tools before switching off the old one.

  1. Export what you have: download the reports you actually use, such as monthly traffic, top pages, sources and conversions, in spreadsheet format. These files will serve as your baseline.
  2. Install the new tool in parallel: add its script without removing Google Analytics. During this period, Google Analytics still requires your visitors' consent.
  3. Compare the numbers: expect discrepancies. An exempt tool also counts visitors who decline the banner. A cookieless tool identifies visitors differently, as Plausible's daily identifier shows. And each tool filters bots in its own way. Focus on trends rather than raw volumes.
  4. Switch off Google Analytics: remove the tag from every page and from your tag manager, then check that no calls to Google remain.
  5. Update your notices: rewrite your privacy policy, adjust or remove the banner if the exemption applies, and add the opt-out. Matomo states that compliance can't be confirmed without an opt-out.

Pro tip: record the exact switchover date in your new tool, for example with an annotation. A year from now, it will keep you from mistaking a break in the curve for a drop in traffic.

Yundera: host your web tools on a private server in France

Yundera lets you self-host your web tools in France without handling the technical side yourself. Yundera provides a managed private server, the Personal Cloud Server, hosted in France and dedicated to a single customer. The server comes with ready-to-use open source applications, including website hosting, file storage, photos and office tools. These apps install in one click from an app store. Before choosing your audience measurement tool, check the app store to see which applications are available.

Yundera

This model addresses the maintenance constraints described above. Each application is available on your own domain over HTTPS, with no static IP, no port forwarding and no certificate to configure. Yundera manages the server, so no technical skills are required. Your data stays on your server: Yundera doesn't collect it or sell it. To understand what the hosting location changes from a legal standpoint, read our article on hosting outside the EU and the GDPR. Even on your own server, the consent exemption still depends on how you configure the tool you choose.

To compare plans and pricing, visit the Yundera private servers page.

Private server vs US SaaS analytics — comparison diagram

The most common mistakes when leaving Google Analytics

The most common mistake is assuming a tool is inherently exempt from consent, when the exemption actually depends on your configuration. The other pitfalls are almost as common:

  • Forgotten opt-out: without an opt-out, compliance can't be confirmed.
  • Out-of-scope features: marketing measurement, cross-referencing with other processing, or a user ID take you outside the exemption.
  • Lost history: the Google tag was removed before the useful reports were exported.
  • Skewed comparison: raw volumes are compared without accounting for the consent Google Analytics requires.
  • Overlooked retention: the CNIL recommends a maximum of twenty-five months for collected information.

In the end, a simple, well-configured tool whose hosting you control beats a feature-rich tool that's poorly set up. Measure only what drives your decisions.

— Yundera

Sources

Frequently Asked Questions

Is Google Analytics banned in France?

No, Google Analytics isn't banned as such. Since the adequacy decision of July 10, 2023, transfers to US companies certified under the Data Privacy Framework are allowed, but the decision is still subject to regular reviews. You also need to collect consent if the tool doesn't meet the CNIL's exemption conditions.

Is Matomo free and GDPR-compliant?

Matomo comes in a Cloud version, hosted by the vendor, and an On-Premise version that you install on your own server. Check the vendor's website for the pricing of each version. On compliance, Matomo states, based on its self-assessment, that both versions meet the CNIL criteria when properly configured.

Can you drop the cookie banner with Matomo or Plausible?

Yes, as long as your configuration meets the exemption: anonymous statistics for your use only, no cross-referencing with other processing, and limited retention periods. For Matomo, you need to enable CNIL mode and offer an opt-out. Plausible doesn't use cookies, but going cookieless doesn't exempt you from checking the CNIL's conditions.

What's the difference between Plausible and Umami?

Plausible is a service that stores visitor data in the EU and relies on a daily identifier that is rotated every 24 hours. Umami is a cookieless open source platform that you can use in the cloud or self-host on your own infrastructure. The main question, then, is who hosts your statistics.

Can you bring your Google Analytics history into another tool?

Before removing the Google tag, at a minimum export your key reports in spreadsheet format so you have a baseline. Whether you can import that history directly into the new tool depends on the tool you choose: check its documentation before switching over.

Recommended Reading

Se connecter pour laisser un commentaire.