# Website analytics privacy ratings

Tools that count website visitors. Some track people across sites, others collect no personal data.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [GoatCounter](https://privacyratings.com/web-analytics/goatcounter/) | C (73/100) | Ireland | Open source web analytics that shows aggregate visitor counts without cookies or stored IP addresses. Available as a hosted service at goatcounter.com or as a self-hosted binary. |
| [Plausible Analytics](https://privacyratings.com/web-analytics/plausible-analytics/) | C (73/100) | Estonia | Lightweight web analytics that counts visits without cookies and shows aggregate stats on a single dashboard. Available as a hosted service or as the self-hosted Community Edition. |
| [Swetrix](https://privacyratings.com/web-analytics/swetrix/) | C (73/100) | United Kingdom (Five Eyes) | Open source, cookieless web analytics with performance monitoring, error tracking and optional session replays. Available as Swetrix Cloud or as the self-hosted Community Edition. |
| [Pirsch](https://privacyratings.com/web-analytics/pirsch/) | C (64/100) | Germany (Fourteen Eyes) | Hosted web analytics from Germany that counts visitors without cookies using a daily hash, with server-side tracking options and a built-in link shortener. |
| [Cloudflare Web Analytics](https://privacyratings.com/web-analytics/cloudflare-web-analytics/) | C (61/100) | United States (Five Eyes) | Free web analytics from Cloudflare that reports page views, visits and Core Web Vitals using a JavaScript beacon or Cloudflare's proxy, without cookies. |
| [Simple Analytics](https://privacyratings.com/web-analytics/simple-analytics/) | C (61/100) | Netherlands (Nine Eyes) | Hosted web analytics from the Netherlands that counts page views and unique visits without cookies, fingerprinting or IP addresses. |
| [Umami](https://privacyratings.com/web-analytics/umami/) | C (61/100) | United States (Five Eyes) | Open source web analytics that tracks page views, referrers and events without cookies. Available as the hosted Umami Cloud or for self-hosting. |
| [Fathom Analytics](https://privacyratings.com/web-analytics/fathom-analytics/) | D (50/100) | Canada (Five Eyes) | Hosted web analytics that counts visitors without cookies using a daily-salted hash, with a single-page dashboard and event tracking. |
| [Matomo](https://privacyratings.com/web-analytics/matomo/) | D (50/100) | New Zealand (Five Eyes) | Open source web analytics platform, formerly Piwik, with detailed reports, goals, heatmaps and a tag manager. Can be self-hosted or used as the hosted Matomo Cloud. |
| [PostHog](https://privacyratings.com/web-analytics/posthog/) | D (48/100) | United States (Five Eyes) | Product analytics platform with web analytics, session replay, feature flags, experiments and surveys. Offered as PostHog Cloud or as an unsupported self-hosted deployment. |
| [Microsoft Clarity](https://privacyratings.com/web-analytics/microsoft-clarity/) | F (27/100) | United States (Five Eyes) | Free behavior analytics from Microsoft that records sessions and builds heatmaps of clicks and scrolling on websites and mobile apps. |
| [Google Analytics](https://privacyratings.com/web-analytics/google-analytics/) | F (23/100) | United States (Five Eyes) | Google's web and app analytics service (GA4) that measures traffic, events and conversions, and connects with Google Ads for audiences and ad measurement. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?
- **No cookies** (weight 2): Does it count visitors without cookies or other identifiers stored on the device?
- **No personal data** (weight 3): Does it avoid storing IP addresses and personal data, and never share data with advertisers?
- **Self-hostable** (weight 1): Can the analytics be self-hosted?

Source: https://privacyratings.com/web-analytics/