# Umami privacy rating

Open source web analytics that tracks page views, referrers and events without cookies. Available as the hosted Umami Cloud or for self-hosting.

## Summary

Umami scores 61 out of 100 (grade C) on the website analytics criteria. It meets 6 of 11 criteria: open source, no ads or data sales, TLS configuration, no cookies, no personal data and self-hostable. It partly meets security headers. It does not meet no trackers or telemetry, independent audit, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://umami.is
- Source code: https://github.com/umami-software/umami
- License: MIT
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google Analytics, Google Tag Manager
- Category: [Website analytics](https://privacyratings.com/web-analytics/)
- Grade: C (61/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | MIT. | https://github.com/umami-software/umami/blob/master/LICENSE |
| No trackers or telemetry | No | The website loads Google Ads conversion tracking (gtag). |  |
| No ads or data sales | Yes | Funded by Umami Cloud subscriptions. The privacy policy states personal information is not sold or shared. | https://umami.is/privacy |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=umami.is&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=umami.is |
| Modern web standards | Not tested yet | Not tested yet. |  |
| No cookies | Yes | The tracking code uses no cookies. | https://docs.umami.is/docs/faq |
| No personal data | Yes | No personally identifiable information is stored and collected data is anonymized. | https://docs.umami.is/docs/faq |
| Self-hostable | Yes | Official instructions for installing from source or with Docker. | https://docs.umami.is/docs/install |

Source: https://privacyratings.com/web-analytics/umami/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/web-analytics/umami.md