Cookieless analytics: Plausible, Fathom, Umami, Matomo and GA4 modeling compared

Cookieless analytics means measuring visits without storing an identifier on the visitor's device. Plausible, Fathom and Umami work that way by default, Matomo can be switched to it, and Google Analytics 4 can fill the gap left by visitors who refuse with Consent Mode modeling. Cookieless does not automatically mean consent-free: in the EU the rule covers any access to the device, and only France (the CNIL's audience measurement exemption) and the UK (the statistical purposes exception) publish conditions under which analytics can run without consent. Pick the tool for what you need to measure, then check it against your authority's conditions.

Why go cookieless at all?

Because consent rates cap what you can measure. With a banner that offers Reject all on the first layer, a large share of visitors refuse, and cookie-based analytics only sees those who accept. A tool that qualifies for an exemption counts everyone, and even where it does not qualify, a cookieless tool collects less personal data, which makes the privacy policy and the processor contract simpler. The trade-off is depth: no user-level journeys, weaker returning-visitor counts, and no advertising audiences.

How do the options compare?

The descriptions come from each vendor's own documentation. "Fits the conditions" is the vendor's assessment, not an approval: the CNIL does not certify analytics tools, and the publisher stays responsible.

Plausible, Fathom and Umami: what do you give up?

All three report page views, referrers, campaigns, countries, devices and goals in aggregate. Plausible's data policy says it uses no cookies, browser cache or local storage and generates no persistent identifiers; its daily salt means the same person counts as a new visitor the next day. Fathom's privacy policy says it uses no cookies and takes the view that it collects no personal data that triggers the ePrivacy consent requirement. Umami's FAQ says its web tracker does not use cookies and that whether you need a cookie notice depends on the other services you use. None of them builds user profiles, which is the point and the limit: you cannot follow one person across weeks or devices.

Matomo without cookies

Matomo sets cookies by default. Its documentation explains how to go cookieless: call disableCookies before trackPageView in the tracking code, or use the setting that disables cookies for all sites. Matomo warns that this can reduce accuracy, because cookies help recognize returning visitors. For France, Matomo documents a CNIL compliance mode that anonymizes at least two bytes of the IP address, disables visitor profiles, the visits log and user IDs, limits tracker lifetime to 13 months, sets retention to about 25 months, and requires an opt-out on your site.

What does the CNIL exemption require?

The CNIL exempts audience measurement trackers from consent when they are:

• used only to measure the audience of the site or app, for the publisher alone;
• used only to produce anonymous statistics;
• not cross-referenced with other processing, such as customer files;
• not used to track a person across different sites or apps.

It also recommends informing users, limiting the tracker lifetime to about 13 months without automatic renewal, and keeping the data 25 months at most. In the UK, the Data (Use and Access) Act 2025 added a statistical purposes exception from 5 February 2026, with clear information and a simple, free way to object. Elsewhere, check your own authority before you remove analytics from the banner.

And Google Analytics 4 with Consent Mode?

GA4 does not fit the exemption: it sends data to Google, which can link it to its advertising systems. What Consent Mode offers instead is modeling. In advanced mode, GA4 tags load with analytics_storage denied, send cookieless pings, and Google estimates the behavior of visitors who refused from those who accepted. Google lists prerequisites for behavioral modeling: at least 1,000 events per day with analytics_storage denied for at least 7 days, at least 1,000 daily users with analytics_storage granted for at least 7 of the previous 28 days, and the Blended reporting identity. Smaller sites usually do not qualify, and meeting the thresholds does not guarantee it. GA4 still needs consent in the EU; Consent Mode is covered in the Consent Mode guide.

Which one should you pick?

• A content site that wants counts for everyone: Plausible, Fathom or Umami, or Matomo in CNIL mode if you want self-hosting and more reports.
• An online shop that runs Google Ads: GA4 with Consent Mode behind the banner, because the ads integration needs it; add a cookieless tool if you want unmodeled totals.
• A site with legal or health content: self-hosted Matomo or Umami, so the data stays on your servers.

Whatever you choose, describe the tool in your privacy policy with its purpose, retention and opt-out. Analytics without consent goes deeper into the French and UK rules.

Do you still need a banner?

For the analytics, maybe not, if the tool and its configuration fit your authority's conditions. For everything else, yes: advertising pixels, embedded videos, chat widgets and maps still need consent. Cookiequiet's scanner recognizes Plausible, Fathom, Umami and Matomo and lists them with their category, which you can set to necessary for an exempt configuration, so they run for everyone while the rest waits. Setup is one script tag before your other scripts, free for one website with unlimited pageviews; the free cookie scanner shows what your site loads today.