GDPR compliant analytics

EU-hosted is one question.
There are three.

“GDPR-compliant analytics” bundles three separate questions: where the data is stored, whether the script touches the visitor’s device (which is what a banner is about) and whether personal data is processed (which is your paperwork). EU hosting answers only the first. Plausible, Simple Analytics, Matomo Cloud and Umami’s EU region each say they store data in the EU; Fathom says it stores anonymised records in the US; and none of that decides whether you need a banner in Germany. Seven tools are laid out below from their own pages, with a checker for your country and setup.

Check my setup The seven tools
Vendor, regulator and law pages Read 12 November 2026

By the Builderify team

  • Where does the data sit? The vendor says. Hosting, company, sub-processors. Plausible says Germany. Fathom keeps anonymised records in the US.
  • Does the script touch the device? The country decides. § 25 TDDDG · CNIL sheet 16. Germany is strict. France exempts a tool that meets seven conditions.
  • Is personal data processed? You decide. User IDs, form values, logins. Matomo’s FAQ counts all three as personal data.
Illustration · The three questions, from the vendors’ pages, the CNIL and German law.
02 / Seven tools

EU analytics tools:
where each says your data sits.

Every cell is what the vendor says on its own pages, read on 12 November 2026, with the pages linked under each name. “EU-hosted” is not one thing: Plausible says all of its providers are European-owned, Matomo Cloud runs on Amazon’s EU entity, Fathom stores in the US, and Umami and Matomo also run on your own server.

Seven analytics tools, from their own pages
Tool Where visitor data sits On the visitor’s device What it says about a banner Paperwork
Plausible Cloud or self-host EU hosting Data policy Falkenstein, Germany (Hetzner); database in Finland (UpCloud); CDN in Slovenia (Bunny). An Estonian company that says visitor data never leaves the EU. Open source, so you can self-host. No cookies and nothing stored on the device; the script only reads a plausible_ignore flag that you or a visitor can set. Visitors are counted with a daily hash whose salt is deleted every 24 hours. Says you need no cookie banner for analytics. Plausible offers a data processing agreement, a legal assessment by a data protection lawyer and a sub-processor list.
Simple Analytics Cloud EU hosting GDPR page What it collects The Netherlands, on EU infrastructure; a Dutch company. Opt-in features such as its AI assistant can send data outside the EU. No cookies, local storage or session storage, and no IP address stored. Country comes from the visitor’s time zone. Says no consent banner is required. Simple Analytics says no processing agreement is required because it processes no personal data, and that it can review and sign one you provide.
Fathom Cloud EU isolation Data journey A Canadian company. EU visitors are routed to EU servers, which remove the IP address; the anonymised records are then stored on Fathom’s US servers. No analytics cookies. A hash of IP address, user agent, site and a daily salt (rotated at midnight UTC) is stored with each event. Describes its dashboard as working without cookie banners. The Fathom pages read for this guide don’t mention a data processing agreement; ask before relying on one.
Matomo Cloud or self-host Consent FAQ Where data sits Sub-processors Cloud: Frankfurt, backups in Dublin, on Amazon Web Services’ EU entity; the company is in New Zealand. Self-hosted: wherever you put it. The optional Ask Matomo AI may process data outside the EU/EEA. You switch cookies off, anonymise IP addresses and avoid user IDs in its settings; its FAQ lists these as the steps for consent-free use. Says it depends on the law and your configuration, and for Germany advises treating script-based tracking as needing consent. Matomo publishes a Cloud data processing agreement and sub-processor list. Self-hosted, no vendor holds the data, so there is none to sign.
Umami Cloud or self-host FAQ Cloud FAQ Cloud: a US or EU region, chosen at sign-up, for analytics storage; CDN routing, security, support and logging may use services outside it. Open source, so you can self-host. Its tracker does not use cookies. Says it depends on the other services you use and the rules that apply. Umami lists a data processing agreement and sub-processors in its Cloud FAQ; self-hosted, you hold the data yourself.
Google Analytics 4 Cloud IP and EU servers Cookies Transfers Google operates data centres worldwide. It drops EU, Swiss and UK IP addresses on servers in those regions and forwards the rest to its Analytics servers; transfers to the US rely on the EU–US Data Privacy Framework. Two first-party cookies, _ga and _ga_<container-id>, 2 years by default. Its cookie page lists the cookies and makes no claim that a banner is unnecessary. Google publishes data protection terms for Measurement and says it relies on the Data Privacy Framework and standard contractual clauses for transfers.
Builderify User Journey Cloud (one script tag) Privacy policy Journey guide Its own servers, “which may be located in Romania or other jurisdictions where we operate” (privacy policy). No EU-only promise. Two first-party cookies: a visitor ID for 400 days and the current visit for 30 minutes. It names a visitor once they log in or fill a form. Its own FAQ says to plan on a banner in the EU and UK. This site’s legal pages are the privacy policy, terms, cookie policy, refund policy, DMCA and affiliate disclosure. There is no data processing agreement page among them, so ask in writing if you need one.

These are the vendors’ claims, not an audit. I haven’t tested any tool’s traffic. Pricing and plans for these tools are in the guides to Plausible, Simple Analytics and Google Analytics alternatives.

Hosted in the EU, owned in the EU, and what each buys you

Simple Analytics and Plausible both argue that a company owned outside the EU stays subject to its home country’s law wherever its servers are, so they stress an EU company, EU infrastructure and, for Plausible, European-owned providers. That is the vendors’ argument; whether it matters for you is a question for your privacy adviser, and the Data Privacy Framework side of it is in the Google Analytics guide. What the table does show is that the three claims differ in fact. Fathom is a Canadian company that processes EU traffic in the EU and stores the anonymised result in the US. Matomo Cloud is in Frankfurt on Amazon’s EU entity, from a company based in New Zealand, whose own FAQ says the EU treats New Zealand as adequate for transfers.

The second pattern is consent. Four tools say they set no cookies by default: Plausible, Simple Analytics and, in its own wording, Fathom say no banner is needed, while Umami says it depends on what else your site runs. Matomo, whose consent-free set-up starts with switching cookies off, is the only vendor whose page I read that names Germany as the exception. Hosting never enters that part of the answer.

03 / Check your setup

GDPR analytics in the EU:
pick yours, get three answers.

Choose the tool, where most of your visitors are, whether an EU-only rule applies and what you will send. You get one answer per question: where the data sits, whether to plan on a banner and what paperwork exists. It runs in your browser and sends nothing anywhere.

1. Which tool?
2. Where do most visitors live?
3. Must all visitor data stay in the EU?
4. What will you send?

Plausible · Germany · must stay in the EU · basic setup

Does the data stay in the EU?

Meets it

The vendor says all visitor data is processed and stored in the EU, which meets an EU-only rule on its own account. Ask for its sub-processor list if a contract wants names.

From the vendor
Falkenstein, Germany (Hetzner); database in Finland (UpCloud); CDN in Slovenia (Bunny). An Estonian company that says visitor data never leaves the EU. Open source, so you can self-host.

Plan on a cookie banner?

Check it

The vendor says no banner is needed. Germany is the strict case: § 25 TDDDG covers reading information on the visitor’s device as well as storing it, and Matomo’s FAQ recommends treating script-based tracking as needing consent, cookies or not, until a German authority says otherwise. A banner is the safe default; going without is a decision for your privacy adviser.

From the vendor
No cookies and nothing stored on the device; the script only reads a plausible_ignore flag that you or a visitor can set. Visitors are counted with a daily hash whose salt is deleted every 24 hours. Says you need no cookie banner for analytics.

What paperwork is there?

Offered

Plausible offers a data processing agreement, a legal assessment by a data protection lawyer and a sub-processor list.

The checker applies what the vendors, the CNIL and German law say on the pages read on 12 November 2026; it can’t see your site or your contracts, and it is not legal advice. Whatever you pick, name the tool and what it collects in your privacy notice, and keep personal data out of URLs, event names and properties. Sources are listed at the end of the page.

04 / Where Builderify fits

Not the banner-free,
EU-only choice.

Builderify User Journey answers a different question from the tools above: who a visitor was, which pages they saw and which visit a sign-up came from. That needs an ID on the device and, once someone logs in or fills a form, their name, so it is not a tool to pick for a no-banner or EU-only requirement. Its privacy policy says data sits on Builderify’s own servers, which may be in Romania or other jurisdictions.

If you need journeys and accept a banner, the pairing is the Wait for cookie consent setting plus the Cookie Consent banner, which records nothing until a visitor allows analytics. It is priced in credits, with 250 free each month. If you only need counts, pick from the table and read what user journey tracking records first.

Which question are you answering?

  • How many people came, and from where?

    Any of the cookie-free tools in the table. They count visits without naming anyone, and their vendors say no banner is needed.

  • Which of them must keep everything in the EU?

    Plausible or Simple Analytics, on their own accounts; Matomo Cloud or Umami with the EU region; or any self-hosted tool on an EU server.

  • Who was the visitor, and what did they do before signing up?

    A journey tool with a banner. That is what Builderify User Journey is for, and what Plausible and Simple Analytics are built not to do.

Questions

GDPR-compliant analytics, before you ask.

No tool is compliant on its own; how you use it is what counts. Plausible, Simple Analytics, Fathom, Umami and Matomo each say they can run without personal data, and they differ on where data sits: Plausible says Germany, Simple Analytics the Netherlands, Matomo Cloud Frankfurt, Umami in the region you choose, and Fathom stores anonymised records in the US. Check the three questions separately: where the data sits, whether the script touches the device, and whether personal data is processed. This is not legal advice.

No. Where the servers are answers the data-transfer question. A banner is about storing or reading information on the visitor's device, which each country's ePrivacy rule governs. Germany's § 25 TDDDG covers both storing and reading, and the CNIL in France exempts audience measurement only under seven conditions, including a 13-month limit on trackers.

Their own pages say no: Plausible says you need no banner for analytics and Simple Analytics says no consent banner is required, because neither sets cookies. In Germany that is not settled by the vendors: Matomo's FAQ recommends treating script-based tracking as needing consent, cookies or not, until a German authority says otherwise. A banner is the safe default there; going without is a call for your privacy adviser.

Partly. Fathom is a Canadian company. It says EU visitors' requests go to EU servers, which remove the IP address, and that the anonymised records are then stored on its US servers. So it processes EU traffic in the EU but does not keep the stored data there, which matters if a contract says all data must stay in the EU.

Matomo says in Frankfurt, Germany, with backups in Dublin, on Amazon Web Services' EU entity, and that the company itself is based in New Zealand. Its optional Ask Matomo AI feature may process data outside the EU and EEA, so leave it off if everything must stay in the EU. Self-hosted Matomo sits wherever you put the server.

Builderify does not promise that. Its privacy policy says data is stored on its own servers, which may be in Romania or other jurisdictions where it operates. User Journey also sets first-party cookies, so plan on a cookie banner in the EU and UK; if an EU-only or no-banner rule applies, pick a tool from the table instead.

Sources

Read on 12 November 2026. Vendor pages are the vendors’ claims. Builderify’s facts are from its privacy policy and Journey pages.

← All guides

More on analytics alternatives

All 9 analytics alternatives guides

The Builderify module behind these guides: User Journey (visitor-level website analytics).

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does