Web analytics without cookies: GDPR-friendly alternatives to GA4

Yes, you can measure your website’s traffic in Denmark without cookies and without a consent banner, provided the tool collects no personal data and stores nothing on the visitor’s device. Cookieless tools such as Umami, Plausible and Matomo (in its cookieless configuration), hosted in the EU, are built for exactly that. What you cannot do is run standard Google Analytics 4 and skip consent: GA4 stores identifiers on the device and processes personal data, so under the Danish cookie order and GDPR it requires prior opt-in, and a large share of your visitors will decline or ignore the banner, leaving you with partial data anyway.

That is the short answer. The longer one is why GA4 became a legal and practical liability, what the rules require of a measurement tool, and how the alternatives compare. This article is deliberately about choosing a tool. The rules themselves are in cookie banners: the rules, and what a banner does to your page speed and rankings is in cookie banners and SEO.

I look after the technical side at NBS, including the analytics on our own site. We are developers, not lawyers; this is practical guidance, not legal advice.

Two separate legal issues collided in Google Analytics, and it helps to keep them apart.

Issue one: cookies and device access. The Danish cookie order (cookiebekendtgørelsen), which implements the ePrivacy Directive, requires consent before anything is stored on or read from a user’s device unless it is strictly necessary to deliver the service the user asked for. Statistics are not strictly necessary. GA4 stores client identifiers on the device, so consent is required before it runs. This part is settled and largely undisputed; it is why the banners exist.

Issue two: data transfers to the US. Between 2020 and 2023, after the CJEU’s Schrems II judgment invalidated Privacy Shield, several European supervisory authorities examined Google Analytics specifically. The Austrian authority (January 2022), the French CNIL (February 2022) and the Italian Garante (June 2022) each found that the implementations they reviewed unlawfully transferred personal data, including IP addresses and online identifiers, to the United States without adequate safeguards. In September 2022 Datatilsynet followed with its own statement: Google Analytics, as configured at the time, could not be used lawfully in Denmark without supplementary measures. Its advice was to stop using the tool, or to put a reverse proxy in front of it that strips identifying data before anything reaches Google. Very few businesses did the latter, because it is more work than switching tool.

In July 2023 the EU–US Data Privacy Framework restored a legal transfer mechanism for certified US companies, Google included. That eased issue two for now, with three caveats. The DPF faces the same kind of challenge that killed its two predecessors, so building your measurement on it is a bet on its survival; the background is in Danish hosting or US cloud?. The pre-DPF rulings were never only about a missing framework; they scrutinised whether identifiers plus metadata are personal data and whether supplementary measures actually work. And the DPF does nothing about issue one: consent for the cookies and identifiers is still required regardless of where the data ends up.

The practical problem on top of the legal one: consent-gated analytics measures only consenting visitors. Opt-in rates for statistics commonly land somewhere between 30% and 70% depending on banner design and audience. Google’s answer, consent mode v2, fills the gap with cookieless pings and modelled conversions. That is legitimate engineering, but it means part of your “data” is a statistical estimate, and the advanced variant still sends signals before consent, which several European regulators view sceptically. You end up maintaining a consent platform, a banner that hurts conversion, and a dataset that is partly modelled, all to keep a free tool.

Stripped of vendor marketing, the requirements stack up like this:

Nothing stored on or read from the device without consent, unless strictly necessary. Genuinely cookieless tools that count visits without storing identifiers avoid this trigger. Note that the requirement is not only about cookies; any device access counts, and regulators treat some fingerprinting techniques as equivalent to cookies.
A lawful basis for any personal data processed. Aggregate, non-identifying statistics can usually rest on legitimate interest; anything with persistent identifiers, cross-site tracking or advertising needs consent.
Data minimisation. Collect page views, referrers and aggregate device data; do not collect what you will not use. IP addresses should be discarded or truncated on arrival.
Known data location and processors. If a US provider processes the data, you rely on the DPF or SCCs plus supplementary measures. EU-hosted or self-hosted removes the transfer question entirely.
Transparency. Whatever you run must be described accurately in your privacy policy.

A useful rule of thumb: the fewer questions your setup raises, the more compliant it tends to be. A tool that stores nothing on devices, identifies nobody and keeps data in the EU raises almost none.

The tools compared: GA4, Matomo, Plausible, Umami

	GA4 with consent mode	Matomo	Plausible	Umami
Consent banner needed	Yes	No in cookieless config (yes in cookie mode)	No	No
Data location	Google’s infrastructure; relies on the DPF	Self-hosted, or Matomo Cloud (EU)	EU cloud, or self-hosted	Self-hosted, or cloud
Cost	Free tool; the real cost is the consent platform, the engineering and the risk	Free self-hosted (server roughly DKK 75–375 a month) or cloud from roughly DKK 150 a month	From roughly DKK 70–150 a month, or self-hosted	Free self-hosted; cloud with a free tier
Depth of analysis	Very deep: funnels, audiences, BigQuery, Ads integration	Deep: funnels, heatmaps, e-commerce (some paid)	Deliberately simple: traffic, goals, UTM, basic funnels	Simple: traffic, events, goals
Data completeness	Partial (consent-gated) plus modelled	Near-complete in cookieless mode	Near-complete	Near-complete
Best fit	Heavy Google Ads spend, product analytics teams	GA-like depth under full EU control	Most small-business marketing sites	Anyone happy to self-host and wanting zero licence cost

Fair notes on each. GA4 remains genuinely powerful, and if your business runs on Google Ads its integration is hard to replace; the trade is legal complexity plus lossy data. Matomo is the most capable European option and the only one approaching GA4’s depth, but self-hosting it is a real operational commitment (updates, scaling, backups), and in cookie mode it needs consent like anything else. Plausible is the pragmatic default for most small and mid-sized businesses: one lightweight script, EU-hosted, and its simplicity is a feature, because most businesses use five reports. Umami is excellent when you have the habit of self-hosting and want no licence cost at all. There are other credible options in the same family (Fathom, Simple Analytics, Pirsch); the four above cover the decision.

What we run ourselves

nbsweb.dk runs a self-hosted Umami on a server in the EU. It sets no cookies, stores nothing on your device and truncates IP addresses on arrival, which is why this site has no cookie banner at all. You can check it while reading: open the developer tools, go to Cookies, and there is nothing there. It is also stated in our privacy policy.

What we get from it is what a service business actually uses: page views, referrers, which pages lead to the contact form, and which countries and devices visitors come from. What we give up is individual user journeys across sessions, remarketing audiences and ad-platform conversion matching. For a content site, a service business or most webshops, that costs you nothing you actually use. For a business spending heavily on paid acquisition, the usual compromise is a hybrid: cookieless analytics as the always-on source of truth, plus consent-gated ad measurement only where the spend justifies the banner.

We set up the same thing for clients as the default, not an add-on. Cookieless analytics is included when we build a website, and keeping it running is part of operations from DKK 375 a month (Basis), excluding VAT; see prices.

How to migrate off GA4 without losing your history

Export what matters. GA4 data cannot be imported anywhere else, so export monthly aggregates (sessions, top pages, referrers, conversions) to a spreadsheet for reference.
Run both in parallel for one or two months. Expect the new tool to report more traffic than GA4, often 20–50% more, because it is not consent-gated. Establish the new baseline before you base decisions on it.
Recreate goals and UTM conventions in the new tool. This is usually an afternoon, not a project.
Remove GA4 and, if statistics was the banner’s only job, the banner with it. Update the privacy policy to describe the new tool. If other consent-requiring scripts remain (ads, embedded video), the banner stays but its scope shrinks.
Write one page of documentation: tool, hosting location, retention period, what is and is not collected. That page answers most of what a customer’s vendor questionnaire will ask.

The bottom line

Cookieless analytics is no longer a compromise product. For the majority of Danish businesses it is simply the better engineering choice: legally quiet, faster pages, no banner tax on conversions, and data that reflects all visitors instead of the consenting subset. Keep GA4 only if you have a concrete, revenue-linked reason, usually deep Google Ads dependence, and accept the consent machinery that comes with it.

This is also where privacy and performance stop being opposites: the compliant setup is the faster one. That is how we approach measurement and search work generally; see SEO, where cookieless analytics is part of the standard job rather than an upsell.

Frequently asked questions

Is Google Analytics illegal in Denmark? No. Datatilsynet’s 2022 statement concerned the tool as configured then and the transfer to the US; the DPF has since restored a transfer mechanism. But GA4 still requires consent before it runs, and that part has not changed.

Do I need a cookie banner for Umami or Plausible? Not in their standard configuration. They store nothing on the device and identify nobody, so there is nothing to consent to. The banner may still be required for other scripts on the site.

Will I lose data by switching? You cannot move GA4 history into another tool, so export the aggregates you care about first. Going forward you will typically see more traffic, not less, because nobody has to opt in.

Can I keep Google Ads conversion tracking? Yes, but it requires consent, so the banner stays for that script. Many businesses run cookieless analytics for everything and consent-gated ad tracking only on campaign landing pages.