We tested 9 cookieless Google Analytics alternatives

Most comparisons of cookieless analytics tools, the privacy-friendly alternatives to Google Analytics, repeat what the vendors say about themselves. We wanted to see for ourselves, so we put nine of them on the same test page, went through the same visit in Chrome, and recorded what each one left in the browser and what it sent.

We also checked them against the ad blocker lists most people use, compared how they tell visitors apart and what they cost, and looked at what an AI assistant like Claude or ChatGPT can do with each. Six of the nine stored nothing in the browser during our visit with their standard install code. Matomo and PostHog store nothing once you switch on their cookieless setting, and Mixpanel still keeps a queue of events in the browser with its own. They differ much more in what they record, what they do with personal data in your URLs, and whether an ad blocker lets them through. Privatrak, our own tool, went through the same test, and its results are reported the same way, including where it does worse.

Tested on 24 October 2026 with each tool’s standard install code. Prices are without VAT and were checked on 23 October. The method is at the end.

The results at a glance

The first column describes each tool’s standard install code. The third counts the nine addresses with an email address, a token or an ID in different places, and how many of them reached the tool without that personal data. The sections below explain every column, and the address test has each case.

What they leave in the browser

Cookieless tracking should mean that nothing is stored on the visitor’s device, not only that there is no cookie. So after the full visit we looked at the browser’s cookies, localStorage, sessionStorage and IndexedDB. Plausible, Fathom, Simple Analytics, Umami, Pirsch and Privatrak had left nothing there.

We also read the code of these six scripts. Plausible, Fathom, Umami and Pirsch read one entry from localStorage, a switch a site owner can set in their own browser to leave out their own visits. Fathom writes that entry only when the site owner asks it to. Privatrak writes to sessionStorage only when an account holder opens its Element Picker on the site. None of the six stores anything about a visitor. One review concluded from the code that Plausible and Fathom use localStorage for session deduplication. They do use localStorage, but in the code we read only for that switch.

Matomo, PostHog and Mixpanel do store something with their standard install code.

• Matomo set two cookies, _pk_id with a visitor ID for 13 months and _pk_ses for 30 minutes.
• PostHog set a cookie and a localStorage entry holding a visitor ID for a year, plus four sessionStorage entries.
• Mixpanel set a localStorage entry holding a visitor ID with no end date, a second one with a queue of events waiting to be sent, two sessionStorage entries and two IndexedDB databases.

In the EU, storing a visitor ID like this for analytics generally needs consent first. Do you need a cookie banner for analytics? explains why.

All three have a setting to work without cookies, so we tested that too. With disableCookies in Matomo and cookieless_mode: 'always' in PostHog, neither stored anything, and both still recorded the same events as before. Mixpanel with disable_persistence: true dropped the visitor ID but kept its queue of unsent events in localStorage. After the visit it still held a click, with an ID. What changes in all three is how they count people.

• Matomo no longer sends a visitor ID. Its own documentation says that unique and returning visitors then become inaccurate, and that a purchase can no longer be credited to the campaign of an earlier visit.
• PostHog sends every event without a visitor ID and works out a daily one on its server, so a person counts as new each day and gets no profile. The mode also has to be switched on in the project settings, or PostHog ignores these events.
• Mixpanel makes a new ID on every page load, so each page view looks like a new visitor. Its documentation adds that properties set once for all later events and the link between an anonymous visitor and a signed-in user stop working.

So Matomo and PostHog are real cookieless options, as long as you change the default code and accept these trade-offs. Mixpanel’s setting still stores something and can no longer tell one visitor from the next.

What they record without extra code

On the test page we clicked a working button, clicked a broken button four times in a row, clicked a picture that looks clickable but does nothing four times in a row, downloaded a PDF, followed a link to another page and one to another site, and sent a newsletter form.

• Plausible, Fathom, Simple Analytics and Umami recorded page views and nothing else. Plausible has switches for outbound links, downloads and forms, but they are off until you turn them on. Every button click needs a line of code from you.
• Pirsch and Matomo also recorded the PDF download and the outbound link, but no button clicks.
• PostHog recorded the clicks on the buttons and links and the form, and flagged the repeated clicks on the broken button. It did the same in cookieless mode. It recorded the clicks on the picture as clicks too, and flagged them as repeated. It can also report clicks that do nothing, but that’s a project setting that is off for new projects.
• Mixpanel recorded the clicks on the buttons and links, flagged the repeated clicks and reported that the broken button did nothing. It did the same for the picture, and reported the PDF download as a click that did nothing too. These clicks come with its session recording, which its quickstart code switches on for every visit. With recording off, it recorded page views only. Its setting without persistence changed nothing here.
• Privatrak recorded the clicks on the buttons and links and the form, flagged the repeated clicks, and also reported that the broken button did nothing. On the picture it recorded no click, but reported that it did nothing and was clicked repeatedly.

The picture shows a difference in what counts as a click. PostHog and Mixpanel counted the clicks on it as clicks. Privatrak counts clicks on buttons, links and other controls only, and watches things that merely look clickable, such as a picture, an icon or underlined text, for clicks that do nothing or are repeated in a hurry.

This matters most for a question you only think of later. Say you decide next month to check how often people use the sign-up button. With a tool that records only what you set up, there’s no history, so you add code and wait. With a tool that records clicks on its own, you name the button and see last month’s clicks too. Of the nine, PostHog, Mixpanel and Privatrak can do that. PostHog needs its cookieless mode for it to work without a cookie, Mixpanel needs session recording on and stores something even with its setting, and Privatrak works that way by default.

Personal data and IDs in the address

Personal data ends up in page addresses more often than you’d think. It turns up in newsletter links, password reset links, login callbacks and account pages. So we opened a set of addresses with personal data or IDs in different places and looked at what each tool sent. We also opened addresses with data that isn’t private and is worth keeping, to see whether a tool throws that away too.

This is the other half of the consent question. A tool that stores nothing in the browser can still receive personal data, and an email address or a customer number in an address is personal data like any other. Sending it to an analytics provider needs a legal basis under the GDPR, which for analytics often means consent. So a tool without cookies only spares you the consent banner if it doesn’t collect personal data either. Do you need a cookie banner for analytics? covers both halves.

Every tool sent a page view for every address, so the table shows what that page view contained. In the first four columns “Sent” means the personal data arrived as it was, “Cut off” that the tool cut that part off the address, and “Redacted” that it replaced the value with a placeholder. The last column is data worth keeping, where “Kept” is the good result.

The addresses were ?email=someone@example.com, the same address under a parameter called u, a password reset link with ?token=…, a login token in a parameter called t, /unsubscribe/someone@example.com, /users/48213/settings, an order number as a UUID, /callback#access_token=…, and a page whose address held an email address before the visitor clicked on, so it went out as the referrer. The data worth keeping were /search?q=running+shoes, /products?page=2&sort=price, a product name, a date and a version number in the path.

• Plausible, Umami, Pirsch, Matomo, PostHog and Mixpanel sent every address as it was, including the token after the #. Their cookieless settings changed nothing here. Mixpanel also sent the full address with every part of its session recording.
• Fathom and Simple Analytics remove most parameters and everything after the #. They keep the campaign tags (utm_…), and Fathom also the search term in q. That keeps email addresses and tokens in parameters out, but also the page number and sorting, and in Simple Analytics the search term. Personal data and IDs in the path still went out.
• Privatrak replaced every email address, token and ID with :redacted or :id, wherever it was, and kept the search, page, sorting, product name and version number. It checks parameter names such as email, token and code, and recognises email addresses and common access keys by their value. What it changes too is any part of the path made only of digits, so /blog/2026/10/launch-notes arrives as /blog/:id/:id/launch-notes.

All of these tools let you filter addresses further yourself. The table shows the defaults, which is what most sites run.

Ad blockers

We checked each tool’s script and the address it sends to against three sets of filter lists. These were the lists uBlock Origin turns on by default, EasyList with EasyPrivacy (which Brave uses), and AdGuard’s base and tracking lists.

Plausible, Fathom, Simple Analytics, Umami, Pirsch, Matomo Cloud and Mixpanel are blocked by all three in their standard setup. PostHog’s script is blocked by all three, and its send address by AdGuard. Privatrak isn’t on any of the lists, most likely because it’s new. That can change with any update of the lists, so don’t choose a tool for it.

If ad blockers matter to you, most of these tools let you send the data through your own domain, which the lists don’t catch as easily. We didn’t test those setups.

How they tell visitors apart

Without a cookie, a tool can’t recognise a returning visitor. So most of them compute a code on the server from the visitor’s IP address and browser, plus a secret that changes regularly. How often it changes decides how long the same person counts as one visitor. This is what each tool documents.

So the same visitor numbers mean different things. A person who visits on Monday and Thursday is one visitor in Umami and in Matomo with its cookie, and two in Plausible, Privatrak or Matomo without cookies. The shorter the time, the less anyone can follow a person, the tool included.

What they cost

The tools charge for different things. Plausible, Fathom, Simple Analytics and Pirsch count page views. Matomo counts hits, which are page views plus downloads, outbound links and other tracked actions. Umami, PostHog, Mixpanel and Privatrak count events, where a page view is one event and every recorded click is another. So the same visit uses up a different amount in each tool, and we didn’t convert between them. The table shows each tool’s published monthly prices, without VAT and without annual discounts.

Plausible, Umami, Matomo and PostHog are also free if you host them yourself. Pirsch counts custom events, and a tenth of the events that extend a session, toward its page views. Mixpanel’s free plan also covers 10,000 session recordings a month. Privatrak can be set to record page views only, and then one page view uses one event.

Asking an AI assistant about your numbers

More people now ask Claude or ChatGPT about their analytics. That works through an MCP server, which connects the assistant to the tool. Some servers only read your numbers, others can also change your setup, and then it matters how you get back to where you were.

For Plausible, Fathom and Pirsch, people have built their own servers. You run them on your computer with an API key, and they read your numbers.

Each tool in short

What each tool did well in the test and where it came off worse, our own included.

Plausible

• Strengths. A tiny script (3 KB), nothing stored in the browser, open source and self-hostable. Downloads, outbound links and forms are one switch away.
• Weaknesses. Sends every address as it is, email addresses and tokens included. Records page views only until you switch more on, and every ad blocker list stops it.

Fathom

• Strengths. The smallest script (2 KB), nothing stored, and most parameters and everything after the # are dropped, so email addresses and tokens there stay out.
• Weaknesses. Personal data and IDs in the path still go out, page number and sorting are lost, there are no funnels, and it’s blocked by every list.

Simple Analytics

• Strengths. Nothing stored, and parameters and the # part are dropped before anything is sent.
• Weaknesses. It doesn’t recognise returning visitors at all, loses the search term, page number and sorting, sends personal data in the path, has no funnels and is blocked by every list.

Umami

• Strengths. Free up to 100,000 events, funnels, self-hostable, and an official MCP server that reads.
• Weaknesses. Sends every address as it is, records page views only without extra code, and is blocked by every list.

Pirsch

• Strengths. Low prices from $6 a month, nothing stored, and downloads and outbound links recorded without extra code.
• Weaknesses. Sends every address as it is, records no button clicks, has no official MCP server and is blocked by every list.

Matomo

• Strengths. Self-hostable, many reports, a cookieless setting that stores nothing, and an official MCP server.
• Weaknesses. A cookie for 13 months with the standard code, a 22 KB script, every address sent as it is, and blocked by every list. Without cookies it recognises a visitor for a day at most.

PostHog

• Strengths. Everything in one tool, clicks recorded without extra code, free up to a million events, self-hostable, and an official MCP server that can also change things.
• Weaknesses. A cookie and localStorage for a year with the standard code, a 104 KB script, and every address sent as it is. Its cookieless mode counts a person as new each day and has to be switched on in two places.

Mixpanel

• Strengths. Records clicks, repeated clicks and clicks that do nothing while it records the session, is free up to a million events, and has an official MCP server with an audit log.
• Weaknesses. A visitor ID in localStorage with no end date, and its setting without persistence still stores a queue and can’t tell visitors apart. It loads 33 KB plus a 103 KB recorder, sends every address as it is, also with every recording upload, and is blocked by every list.

Privatrak

• Strengths. Nothing stored, clicks on buttons, links and forms recorded and clicks that do nothing found, personal data in addresses replaced while search and sorting stay, and an MCP server whose changes can be undone.
• Weaknesses. A 14 KB script, and numbers in the path grouped as :id unless you switch that off. You can’t host it yourself, and it’s new, so there are fewer integrations, guides and community answers.

Which cookieless analytics tool to pick

• If you only want to know how many people came and from where, take Fathom, Plausible or Pirsch. Fathom and Simple Analytics keep email addresses in parameters out of your data by default.
• If you want funnels and want to pay little, take Umami.
• If you want to host it yourself, take Umami, Plausible or Matomo. Matomo also works without cookies once you change its default code.
• If you want everything in one tool, take PostHog or Mixpanel with a cookie banner. PostHog’s cookieless mode works too, with the trade-offs above.
• If you want to know which features people use and where clicks fail, without a cookie banner, take Privatrak.

How we tested

We made one test page with a working button, a broken button, a picture with a pointer cursor that does nothing, a link to a PDF, a link to another page, a link to another site and a newsletter form. For each tool we added its standard install code with a made-up site ID, opened the page in Chrome 155, and ran the same visit by script. In a second run we opened the addresses with personal data, IDs and data worth keeping, one after the other.

Each tool went through one scripted visit of about a minute. What we report is what happened in that visit, and for the six smaller scripts also what their code shows. Features we didn’t use, such as surveys or feature flags, may store or send more on other sites.

Nothing reached the vendors. Chrome sent every request to a local server on our machine, which served the page and each tool’s script, downloaded on 23 October, and recorded everything the tools sent. The test page was served over HTTPS under a made-up domain, so the tools behaved as on a real site.

• Plausible gives each site its own script with that site’s settings. We used its official npm package with its documented defaults, which is the same code.
• Matomo, PostHog and Mixpanel were tested twice, with the standard code and with their cookieless setting.
• PostHog waits for its server’s settings before it records clicks. We answered with what its server sends a new project, taken from PostHog’s source code: click recording on, heatmaps and detection of clicks that do nothing off.
• Mixpanel got the code and options from its JavaScript quickstart, which records every visit as a session and collects click data for heatmaps. Its separate click recording setting is off by default. Our server confirmed each batch the way Mixpanel’s does, since Mixpanel keeps a batch and sends it again until it is confirmed.
• Privatrak reads its settings from its server too. We answered with the settings a new project gets.

The ad blocker check used the filter lists as published on 23 October 2026 and Ghostery’s matching engine, which applies the same rules as the blockers.

The test code and every raw result are on GitHub at Privatrak/cookieless-analytics-test, so you can check our numbers or run the test yourself.