# GoatCounter privacy rating

Open source web analytics that shows aggregate visitor counts without cookies or stored IP addresses. Available as a hosted service at goatcounter.com or as a self-hosted binary.

## Summary

GoatCounter scores 73 out of 100 (grade C) on the website analytics criteria. It meets 7 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, no cookies, no personal data and self-hostable. It does not meet independent audit, transparency report, tells users about requests and security headers. It is based in Ireland: Not in the Five, Nine or Fourteen Eyes; EU member (GDPR). Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade F.

- Website: https://www.goatcounter.com
- Source code: https://github.com/arp242/goatcounter
- Jurisdiction: Ireland. Not in the Five, Nine or Fourteen Eyes. EU member (GDPR).
- Platforms: Web
- Home page trackers: none found
- Category: [Website analytics](https://privacyratings.com/web-analytics/)
- Grade: C (73/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | EUPL-1.2, with a shortened list of compatible licenses. | https://github.com/arp242/goatcounter/blob/master/LICENSE |
| No trackers or telemetry | Yes | The website loads no third-party trackers, and the privacy policy states no information is shared with third parties. | https://www.goatcounter.com/help/privacy |
| No ads or data sales | Yes | Funded by donations and paid plans, with no ads. | https://www.goatcounter.com/contribute |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=www.goatcounter.com&hideResults=on |
| Security headers | No | Grade F (15/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.goatcounter.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| No cookies | Yes | Nothing is stored in the browser with cookies, localStorage, cache or other methods. | https://www.goatcounter.com/help/privacy |
| No personal data | Yes | IP addresses and User-Agent headers are only held in memory for session counting and never stored to disk. | https://www.goatcounter.com/help/sessions |
| Self-hostable | Yes | Official binaries and instructions for self-hosting are provided. | https://github.com/arp242/goatcounter#self-hosting-goatcounter |

Source: https://privacyratings.com/web-analytics/goatcounter/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/web-analytics/goatcounter.md