# Cookieless analytics: Plausible, Fathom, Umami, Matomo and GA4 modeling compared

> Cookieless analytics options compared: Plausible, Fathom, Umami, Matomo without cookies, GA4 with Consent Mode modeling, and the CNIL exemption conditions.

Source: https://cookiequiet.com/guides/cookieless-analytics-options
Published: 2026-10-21
Publisher: Cookiequiet

Cookieless analytics means measuring visits without storing an identifier on the visitor's device. Plausible, Fathom and Umami work that way by default, Matomo can be switched to it, and Google Analytics 4 can fill the gap left by visitors who refuse with Consent Mode modeling. Cookieless does not automatically mean consent-free: in the EU the rule covers any access to the device, and only France (the CNIL's audience measurement exemption) and the UK (the statistical purposes exception) publish conditions under which analytics can run without consent. Pick the tool for what you need to measure, then check it against your authority's conditions.

## Why go cookieless at all?

Because consent rates cap what you can measure. With a banner that offers Reject all on the first layer, a large share of visitors refuse, and cookie-based analytics only sees those who accept. A tool that qualifies for an exemption counts everyone, and even where it does not qualify, a cookieless tool collects less personal data, which makes the privacy policy and the processor contract simpler. The trade-off is depth: no user-level journeys, weaker returning-visitor counts, and no advertising audiences.

## How do the options compare?

| Tool | Cookies by default | How visitors are counted | Hosting | Fits the CNIL conditions |
|---|---|---|---|---|
| Plausible | None | Hash of a daily salt, the site domain, IP address and user agent; salt deleted every 24 hours | EU cloud or self-hosted | Designed for them, per the vendor |
| Fathom | None | No cookies or stored identifiers, per its privacy policy | Cloud | Vendor's assessment |
| Umami | None | No cookies in the web tracker | Cloud or self-hosted | Depends on configuration |
| Matomo | Yes, unless disabled | Cookies; less precise returning-visitor counts when cookies are disabled | Cloud or self-hosted | Yes, with its CNIL compliance mode |
| Google Analytics 4 | Yes (`_ga`, `_ga_*`) | Cookies when granted; cookieless pings and modeling when denied | Google | No |

The descriptions come from each vendor's own documentation. "Fits the conditions" is the vendor's assessment, not an approval: the CNIL does not certify analytics tools, and the publisher stays responsible.

## Plausible, Fathom and Umami: what do you give up?

All three report page views, referrers, campaigns, countries, devices and goals in aggregate. Plausible's data policy says it uses no cookies, browser cache or local storage and generates no persistent identifiers; its daily salt means the same person counts as a new visitor the next day. Fathom's privacy policy says it uses no cookies and takes the view that it collects no personal data that triggers the ePrivacy consent requirement. Umami's FAQ says its web tracker does not use cookies and that whether you need a cookie notice depends on the other services you use. None of them builds user profiles, which is the point and the limit: you cannot follow one person across weeks or devices.

## Matomo without cookies

Matomo sets cookies by default. Its documentation explains how to go cookieless: call `disableCookies` before `trackPageView` in the tracking code, or use the setting that disables cookies for all sites. Matomo warns that this can reduce accuracy, because cookies help recognize returning visitors. For France, Matomo documents a CNIL compliance mode that anonymizes at least two bytes of the IP address, disables visitor profiles, the visits log and user IDs, limits tracker lifetime to 13 months, sets retention to about 25 months, and requires an opt-out on your site.

## What does the CNIL exemption require?

The CNIL exempts audience measurement trackers from consent when they are:

- used only to measure the audience of the site or app, for the publisher alone;
- used only to produce anonymous statistics;
- not cross-referenced with other processing, such as customer files;
- not used to track a person across different sites or apps.

It also recommends informing users, limiting the tracker lifetime to about 13 months without automatic renewal, and keeping the data 25 months at most. In the UK, the [Data (Use and Access) Act 2025](/laws/uk-gdpr-pecr) added a statistical purposes exception from 5 February 2026, with clear information and a simple, free way to object. Elsewhere, check your own authority before you remove analytics from the banner.

## And Google Analytics 4 with Consent Mode?

GA4 does not fit the exemption: it sends data to Google, which can link it to its advertising systems. What Consent Mode offers instead is modeling. In advanced mode, GA4 tags load with `analytics_storage` denied, send cookieless pings, and Google estimates the behavior of visitors who refused from those who accepted. Google lists prerequisites for behavioral modeling: at least 1,000 events per day with `analytics_storage` denied for at least 7 days, at least 1,000 daily users with `analytics_storage` granted for at least 7 of the previous 28 days, and the Blended reporting identity. Smaller sites usually do not qualify, and meeting the thresholds does not guarantee it. GA4 still needs consent in the EU; Consent Mode is covered in [the Consent Mode guide](/guides/google-consent-mode-v2).

## Which one should you pick?

- **A content site that wants counts for everyone:** Plausible, Fathom or Umami, or Matomo in CNIL mode if you want self-hosting and more reports.
- **An online shop that runs Google Ads:** GA4 with Consent Mode behind the banner, because the ads integration needs it; add a cookieless tool if you want unmodeled totals.
- **A site with legal or health content:** self-hosted Matomo or Umami, so the data stays on your servers.

Whatever you choose, describe the tool in your privacy policy with its purpose, retention and opt-out. [Analytics without consent](/blog/analytics-without-consent) goes deeper into the French and UK rules.

## Do you still need a banner?

For the analytics, maybe not, if the tool and its configuration fit your authority's conditions. For everything else, yes: advertising pixels, embedded videos, chat widgets and maps still need consent. Cookiequiet's scanner recognizes Plausible, Fathom, Umami and Matomo and lists them with their category, which you can set to necessary for an exempt configuration, so they run for everyone while the rest waits. Setup is one script tag before your other scripts, free for one website with unlimited pageviews; the [free cookie scanner](/tools/cookie-scanner) shows what your site loads today.

## Questions

### Is cookieless analytics automatically GDPR compliant?

No. Cookieless tools still process IP addresses and user agents, which are personal data under the GDPR, so they need a legal basis and a mention in the privacy policy. Whether they also need consent under the ePrivacy rules depends on your authority's position.

### Can Google Analytics 4 run without consent if I turn on Consent Mode?

No. Consent Mode adjusts what GA4 stores and sends when consent is denied, but Google says you remain responsible for obtaining consent, and GA4 does not fit the CNIL exemption because data goes to Google for its own purposes.

### Why does my site not get modeled data in GA4?

Google requires minimum volumes for behavioral modeling, including 1,000 events a day with analytics storage denied for seven days and 1,000 daily users with it granted, plus the Blended reporting identity. Many small sites stay below those thresholds.

### Does Matomo without cookies count unique visitors correctly?

Less precisely. Matomo says disabling cookies can affect the accuracy of reports because cookies help recognize returning visitors. Page views and visits remain reliable; unique and returning visitor counts become estimates.

## Sources

- [CNIL, Cookies : solutions pour les outils de mesure d'audience (updated 4 July 2025)](https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience)
- [Plausible Analytics, Data policy](https://plausible.io/data-policy)
- [Fathom Analytics, Privacy policy](https://usefathom.com/privacy)
- [Umami documentation, FAQ](https://docs.umami.is/docs/faq)
- [Matomo, How do I go cookieless (disable Matomo cookies) for a visitor?](https://matomo.org/faq/general/faq_157/)
- [Matomo, How do I configure Matomo without tracking consent for French visitors (CNIL exemption)?](https://matomo.org/faq/how-do-i-configure-matomo-without-tracking-consent-for-french-visitors-cnil-exemption/)
- [Google Analytics Help, Behavioral modeling for consent mode (prerequisites)](https://support.google.com/analytics/answer/11161109)
- [ICO, Guidance on the use of storage and access technologies: what are the exceptions?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)