# Plausible Analytics privacy rating

Lightweight web analytics that counts visits without cookies and shows aggregate stats on a single dashboard. Available as a hosted service or as the self-hosted Community Edition.

## Summary

Plausible Analytics scores 73 out of 100 (grade C) on the website analytics criteria. It meets 7 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, no cookies, no personal data and self-hostable. It does not meet independent audit, transparency report, tells users about requests and security headers. It is based in Estonia: Not in the Five, Nine or Fourteen Eyes; EU member (GDPR). Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade D.

- Website: https://plausible.io
- Source code: https://github.com/plausible/analytics
- License: AGPL-3.0
- Jurisdiction: Estonia. Not in the Five, Nine or Fourteen Eyes. EU member (GDPR).
- Platforms: Web
- Home page trackers: none found
- Category: [Website analytics](https://privacyratings.com/web-analytics/)
- Grade: C (73/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | All code is public. The Community Edition is AGPL-3.0, and code for hosted-only features in the extra directory of the same repository is published under a source-available proprietary notice. | https://github.com/plausible/analytics/blob/master/extra/COPYING.txt |
| No trackers or telemetry | Yes | No third-party trackers. The website uses Plausible's own analytics, which are cookieless and aggregate-only. | https://plausible.io/privacy |
| No ads or data sales | Yes | Funded by subscriptions. The privacy policy states data is never sold or used for advertising. | https://plausible.io/privacy |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=plausible.io&hideResults=on |
| Security headers | No | Grade D (30/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=plausible.io |
| Modern web standards | Not tested yet | Not tested yet. |  |
| No cookies | Yes | The script sets no cookies and generates no persistent visitor identifiers. | https://plausible.io/data-policy |
| No personal data | Yes | Raw IP addresses and User-Agent strings are not stored, and a daily visitor hash is used instead. | https://plausible.io/data-policy |
| Self-hostable | Yes | The Community Edition is officially offered for self-hosting. | https://plausible.io/self-hosted-web-analytics |

Source: https://privacyratings.com/web-analytics/plausible-analytics/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/web-analytics/plausible-analytics.md