Google Analytics alternatives: measuring without a cookie banner

Yes, you can measure a site’s audience in France without a cookie banner and without collecting visitor consent. The CNIL provides an explicit exemption, under precise conditions. No, Google Analytics does not qualify in its standard configuration, for a reason that has nothing to do with data transfers to the United States. Matomo, Plausible and Umami, properly configured, do qualify.

This is the real subject in 2026, and it is framed badly almost everywhere. People keep debating whether Google Analytics is lawful, while the question that actually changes your numbers, your loading speed and your user experience lies elsewhere: are you measuring one hundred percent of your traffic, or only the share of visitors who accept the banner?

The debate on transfers to the United States has closed

A useful reminder, because many companies stopped following the story there. In February 2022, the CNIL issued formal notices to several website operators using Google Analytics, on the grounds that transfers to the United States were not sufficiently protected after the Privacy Shield was struck down. The CNIL still maintains a page on bringing audience measurement tools into compliance.

The framework has changed since. On 10 July 2023 the European Commission adopted a new adequacy decision, the EU-US Data Privacy Framework. It was challenged, and the General Court of the European Union dismissed that action on 3 September 2025 in case T-553/23. The adequacy decision therefore stands, subject to the ongoing review the Commission has to carry out.

The practical conclusion: “Google Analytics is illegal” is no longer the right angle. The subject has moved, and it has become more interesting.

What the CNIL actually says about the consent exemption

Article 82 of the French Data Protection Act requires consent for reading or writing information in a user’s device, with exceptions. Audience measurement is one of them, under conditions. The CNIL reference page sets them out unambiguously.

To be exempt, trackers must be used for a purpose strictly limited to measuring the audience of the site, for the sole account of the publisher, and must produce anonymous statistical data only. The CNIL spells out what that purpose covers: measuring performance, detecting navigation problems, optimising technical performance or ergonomics, estimating the server capacity required, and analysing which content is viewed.

Three things are prohibited. Cross-referencing the data with other processing, or transmitting non-anonymous data to third parties. Tracking a person’s browsing globally across different sites or applications. And using a single identifier across several sites to measure unified reach, which the CNIL excludes explicitly.

Three quantified recommendations come on top, and they matter because they reappear verbatim in the tools’ configuration: inform users, for example through the privacy policy; limit the lifetime of the trackers to thirteen months with no automatic renewal on each new visit; and keep the collected information for at most twenty-five months, with both durations subject to periodic review.

There is no longer a list of approved solutions

This is the point most articles miss, and it changes how you choose. The CNIL does not publish a list of exempt solutions. It provides vendors with a self-assessment tool that lets them determine whether their product can be configured to fall within the exemption.

The consequence is twofold. First, no vendor can claim a label: the CNIL explicitly forbids presenting a solution as “certified” or “approved by the CNIL”, and forbids using its logo or any derivative. The wording it recommends is far more cautious, along the lines of “based on our self-assessment, the solution meets the criteria set by the CNIL and can be implemented without requiring user consent if correctly configured”.

Second, the burden of proof moves up to you. The CNIL invites publishers to question their vendors, to ask for the documents evidencing compliance with the framework and for the operational details of the implementation. In the event of an inspection, both the controller and the processor can be held liable. In other words, keep the vendor’s self-assessment and a screenshot of your configuration on file. It is the same documentary reflex as for GDPR compliance of a website in general.

Why Google Analytics falls outside the exemption

The reason fits in one CNIL sentence, and it is not about geography. Some offerings fall outside the scope of the exemption, in particular where their providers state that they reuse the data for their own account. That is precisely the Google Analytics model, whose data feeds Google’s advertising ecosystem beyond the publisher’s own needs.

The CNIL does add a nuance: in some cases these tools can be configured to disable the reuse of data. But the exercise remains fragile, poorly documented on the vendor’s side, and it will be up to you to demonstrate it.

A second, less discussed limit is retention. In Google Analytics 4, user-level data can only be kept for two or fourteen months, fourteen months being the ceiling for standard properties. Comparing one season with the same season a year earlier therefore becomes impossible beyond that point, unless you export to a third-party warehouse. Many teams discover the limit at the exact moment they need it.

Google Analytics remains perfectly usable. It simply requires a consent banner, and therefore partial measurement.

What consent really costs your numbers

This is the economic argument, and it is stronger than the legal one. With a tool subject to consent, you only measure the visitors who clicked “accept”. The rest disappear from your reports, or come back as modelled data, meaning estimated.

The practical effects are unpleasant. Your traffic figures cannot be compared with Search Console, which counts everything. The acceptance rate varies by device, browser and banner position, so simply redesigning the banner shifts your curves without a single visitor changing behaviour. And the segments most concerned about privacy, often the technical profiles, are systematically under-represented.

With an exempt solution, you measure the whole of your traffic, with no banner and with stable time series. For most company websites, that is a gain in reliability well above the analytical detail you give up.

The three serious alternatives

Matomo is the most complete, and the only one for which the CNIL hosts a configuration guide dedicated to the exemption. The required configuration is strict, and that is exactly what makes it defensible in an inspection: masking two bytes of the IP address, stripping campaign parameters at ingestion, disabling heatmaps, session recording, A/B testing and the user ID, first-party cookies only, retention capped at around twenty-five months, and an opt-out link embedded in the privacy policy. On pricing, the Cloud offer starts at 29 euros a month with storage in Frankfurt, and the self-hosted Community edition is free with no volume limit.

Plausible approaches the problem from the other end: it is designed without cookies. Its data policy states that it uses no cookies, no browser cache and no local storage, and generates no persistent identifier. Unique visitors are recognised through a hash computed on a daily salt that is destroyed every twenty-four hours, which makes cross-referencing from one day to the next impossible. The data is processed and stored in the European Union. Pricing starts at 9 dollars a month for ten thousand pageviews, with a thirty-day trial and no credit card required, and the code is open for anyone who wants to host it.

Umami is the lightest and most frugal option: open source, self-hostable on a small instance, and cookieless as well. It is an excellent choice when measurement mainly serves to follow trends and popular pages, and the technical team is already comfortable with an in-house deployment. That logic matches the one we describe in our guide to GAFAM alternatives.

The forgotten argument: script weight

Audience measurement runs on the visitor’s device, ahead of everything else. On 9 September 2026 we measured the weight of the scripts actually downloaded, as served by each vendor, counting the bytes really transmitted and then their uncompressed size.

• Google Analytics 4 through gtag.js: roughly 144 kilobytes transmitted, 428 kilobytes once uncompressed.
• Matomo: roughly 46 kilobytes transmitted, 153 kilobytes uncompressed.
• Umami: roughly 2.3 kilobytes transmitted, 4.6 kilobytes uncompressed.
• Plausible: roughly 1.2 kilobytes transmitted, 2.8 kilobytes uncompressed.

That is a factor of one hundred and twenty between the two extremes in transmitted bytes. It is not only a bandwidth question: it is JavaScript to parse and execute on the phone’s processor, so it is time added before interactivity. On a site that is already tight on performance, replacing the analytics tool is one of the rare optimisations that costs nothing in visible functionality, and we cover it in our article on Core Web Vitals.

What you lose, and when not to migrate

It is worth being honest about the trade-offs, because they are real. You lose the individual visitor journey, rebuilt audiences, fine-grained multi-touch attribution, and above all the native integration with Google Ads. The exemption configuration itself deliberately deprives you of heatmaps and session recording, which are useful design tools.

So there is a case where you should not migrate entirely: if your acquisition relies on significant Google Ads budgets, importing conversions into Google Ads has an operational value that nothing replaces today. The sensible answer is then dual measurement. An exempt tool with no banner for your reference figures, the ones used to steer the business, and Google Analytics kept behind consent purely for advertising optimisation.

For everyone else, brochure sites, content sites, business applications, software vendors, removing it outright is simpler to maintain and more comfortable to defend. It follows the same logic as our thinking on digital sovereignty for SMEs, and it is far less demanding than changing email or office suite, a subject we covered with Proton.

How to proceed, in four steps

Start by measuring your current acceptance rate. If a large majority of visitors accept your banner and you live off Google Ads, the subject is less urgent. If it sits around half or below, you are already steering half blind and the calculation is quickly done.

Then install the alternative in parallel, without removing anything, for two to four weeks. You will get the only figure that really matters in this decision: the gap between real traffic and consented traffic, on your own data. That comparison will also convince a management team far better than a legal argument.

Next, ask the vendor for their self-assessment and their configuration guide, apply the exemption configuration to the letter, and archive both documents together with a screenshot of your settings. Finally, remove the banner only if it existed solely for audience measurement. If it also covers advertising pixels, a third-party interactive map or embedded videos, it remains necessary for those trackers, and you will have to deal with each of them separately.

What we take away from it

The right question is no longer “am I allowed to use Google Analytics” but “what share of my traffic am I actually measuring”. The exemption provided by article 82 allows you to get back to one hundred percent, provided you choose a tool that does not reuse the data for its own account and configure it strictly.

Three benefits arrive together: complete and stable figures, one banner fewer on the homepage, and an analytics script a hundred times lighter. Three things are given up as well: the individual journey, fine behavioural analysis and native advertising integration. The evidence file, meanwhile, stays your responsibility.

We support this kind of switch on projects where measurement and compliance matter as much as speed, as part of our sovereign applications work. If you want to know what you are not measuring today, let’s talk.