“Cookieless” is a description of the plumbing, not a privacy rating
Every tool on this page avoids writing an identifier to the visitor’s device, and every one of them is entitled to the label. That shared label hides most of what actually distinguishes them, because cookieless analytics covers at least three different techniques with very different properties — from storing no identifier at all, through a server-derived identifier that rotates on a schedule, to fingerprinting, which is cookieless in the strictest sense and the least private thing in the category.
So this roundup is organised around a question the feature grids skip: what is the identifier made of, and how long does it stay valid? For a broader feature comparison of these tools, see the best open-source analytics tools; for the operational side, the best self-hosted analytics.
The number that decides how private a cookieless tool is
Almost every tool in this category works the same way underneath: hash the visitor’s IP address and User-Agent together with a secret, and use the result as that day’s identifier. The technique is sound. Its privacy value depends almost entirely on one parameter nobody puts in a comparison table — the rotation period.
A salt that rotates daily means yesterday’s identifiers cannot be linked to today’s. A salt that rotates monthly means a visitor is linkable across four weeks of browsing. Both are cookieless. Both use a salted hash. One is a fundamentally different privacy proposition from the other, and the word on the marketing page is identical.
Ask two questions of any cookieless vendor: how often does the salt rotate, and is the old one deleted or kept? Rotation without deletion is a scheduling detail, not a guarantee — retained salts make the whole history re-derivable at will.
Disclosure here is genuinely patchy. Plausible and Fathom both document daily rotation. Umami exposes salt rotation as a configurable setting, but it does not appear in its published environment-variable reference at all, so a self-hoster reading the docs will not learn what their own rotation period is. That is worth checking against your own deployment rather than assuming a default.
Web analytics — the established options
Plausible
The best-known privacy-first option and a reasonable default for most sites. Cookieless by design, with a visitor identifier derived from a salt that rotates daily, and a famously small script. AGPL-3.0, self-hostable as the Community Edition on Elixir with Postgres and ClickHouse. It has added conversion funnels and a User Journeys path report, though it stays aggregate — no per-person profiles. Best for: clean, well-documented traffic analytics with a credible privacy story. See the Plausible comparison.
Fathom
A paid, closed-source SaaS built on the same daily-rotating approach — the identifier combines IP, User-Agent, site domain and a secret salt. Not self-hostable and not open source, which rules it out if ownership is the point, but it is polished, simple, and has been consistent about its privacy position for years. Best for: teams who want privacy-first traffic analytics and would rather pay than operate anything.
Umami
MIT-licensed and the lightest of these to self-host — Node with a single Postgres or MySQL database, comfortable on a small VPS. Cookieless, with a server-derived identifier, and v2 added funnels, retention and journeys while staying aggregate. The caveat above applies: salt rotation is configurable but undocumented in the public environment-variable reference, so confirm it in your own install. Best for: a minimal, low-maintenance dashboard you run yourself. See the Umami comparison.
Matomo
The fullest open-source Google Analytics replacement, on PHP and MySQL. Cookieless is a configuration rather than the default — Matomo can run without cookies, and does so in the setups that qualify for regulator exemptions, but you have to choose it. More capability means more to operate, and heatmaps and session recordings are paid plugins. Best for: a complete GA replacement where you need the marketing features too. See the Matomo comparison.
Cloudflare Web Analytics
Free, cookieless and aggregate-only, with no client-side state. The trade-off is scope: it reports traffic and little else, and it fits naturally if you are already on Cloudflare. Best for: basic traffic numbers at zero cost and zero operational effort.
Product analytics — a different category
Everything above measures traffic. If you need to know which steps people drop out of, whether they come back, and what a specific account is doing, that is product analytics, and cookieless has historically not been on offer there — because rotation is precisely what breaks the metrics product analytics exists to produce.
PostHog
Broad and open-source (MIT): analytics, replay, flags, experiments. It can be configured for cookieless operation, but it is not the default posture and the platform is built around identified users. Self-hosting is a community Docker Compose deployment that PostHog does not support for production. Best for: teams wanting maximum breadth who will accept the ops and are not leading with cookieless. See the PostHog comparison.
Pug
Open-source (AGPL-3.0) product analytics that starts cookieless rather than treating it as a mode. The Web SDK writes nothing to the device by default; the server derives an identifier from a keyed hash of project, IP and User-Agent under a salt that rotates daily and is deleted when its TTL expires rather than archived. IP and User-Agent are hash inputs only and never stored on the event.
The honest part is what that costs. Those identifiers are excluded by default from unique users, funnels, retention
and user flows, because
a daily-rotating identifier counted as a person inflates every
one of them — while event totals and all session metrics keep counting cookieless traffic, since excluding it would
under-count real volume. Grant consent and identify() merges that history into a profile, so cookieless
is the floor rather than the ceiling. SDKs are Web, Flutter and Node, and it is in open beta today.
Best for: teams who want product analytics without asking for consent before they have measured anything.
How to choose
- You want traffic stats and nothing more. Plausible if you want the best-documented option, Umami if you want the lightest to self-host, Cloudflare if you want free and are already there.
- You want a full GA replacement. Matomo, configured for cookieless operation — and verify that configuration rather than assuming it.
- You want behaviour, not just traffic. That is product analytics. PostHog for breadth; Pug if you want cookieless as the default rather than a setting, and a smaller stack to run.
- You would rather not self-host anything. Fathom is the most established paid option in this category.
- Whatever you pick, check the rotation period. It is the parameter that decides what your privacy claim is actually worth, and it is the one most likely to be missing from the docs.
One closing caution: no tool on this page makes you compliant by itself. Cookieless narrows the problem by removing the device-storage trigger, but GDPR still governs the processing that follows, and the assessment depends on your deployment as much as on the software. GDPR compliance for analytics covers the framework. None of this is legal advice.