Privacy-friendly analytics: 5 checks you can run on any script

Privacy-friendly analytics is a claim you can test in the browser. Measure the script, look for cookies or localStorage, click Reject and watch the network tab, read what the request sends, and see where it goes. We measured six public scripts that way on 9 November 2026.

Five checks you can run on any script

Privacy-friendly analytics means web analytics you can inspect yourself: a script whose size you can measure, no cookie or lasting browser identifier unless you can see one, a request that still makes sense after Reject, a payload you can read, and a destination you can name.

On a site that already loads an analytics tag, you do not need a vendor account to see what that tag does. Open the page in a fresh window, open developer tools, and run the five checks below. They work on Cookie Free Analytics, on Plausible, Fathom, Simple Analytics, OpenPanel, Google Analytics, and on any other script you can load.

1. Measure the script.

2. Look for cookies, localStorage and a fingerprint.

3. Click Reject and watch the network tab.

4. Read what the request sends.

5. See where the request goes.

1. Measure the script

A smaller file is not automatically kinder to visitors, but a large file is a fact you can record. In Chrome, Edge or Firefox, open developer tools, open the Network tab, tick Disable cache, and reload. Click the analytics script and read the transferred size. That figure includes HTTP compression.

To measure the file the same way we do, fetch it once and compress it with gzip at level 9, without a filename in the header:

curl -sL SCRIPT_URL | gzip -9 -n | wc -c

On 9 November 2026 we fetched six public scripts once with curl -sL and measured them that way.

Cookie Free Analytics is 930 bytes gzipped. Plausible's legacy snippet is about 1.4 times that. GA4's gtag.js with a placeholder ID is about 166 times that (154,426 ÷ 930). Simple Analytics announced embed script v12 on 28 October 2026; between our 19 October and 9 November runs, its latest.js went from 3,826 to 4,793 bytes gzipped.

The method, the same table, and later re-measures live on Analytics script size compared.

2. Look for cookies, localStorage and a fingerprint

After the script has loaded, open the Application tab (Storage in Firefox). Check Cookies for the site and for the analytics host. Check localStorage and sessionStorage. In the Network tab, look at the script response and later beacons for a Set-Cookie header. In the console you can also read document.cookie.

A privacy-friendly pageview script should leave those stores empty. A lasting identifier in localStorage is not a cookie, but it still identifies the browser after a reload. Some scripts also read canvas, WebGL or a long list of device properties to build a fingerprint; you will see those calls in the script source or as extra requests.

How a visitor is counted is our own write-up of this check: Cookie Free Analytics sets no cookie and no localStorage id. A visitor is counted for one UTC day with a salted hash, and the salt is deleted daily. The raw IP is discarded.

What “no cookie” does not mean

No cookie does not mean “no record of the visit.” The server can still store a pageview row. It means the browser did not keep an id that you can read back later. If you see a cookie or a storage key appear after the script loads, the vendor's “cookieless” line needs a closer look.

3. Click Reject and watch the network tab

If the site shows a cookie banner, click Reject (or the equivalent decline control). Keep the Network tab open and reload, or click another internal link. Look for a new analytics request after that choice.

A tool that needs consent for pageviews will usually send nothing once Reject is stored — or it will send a request that the vendor later fills with modeled data. A cookieless pageview script can still send a hit, because it is not reading a consent cookie to decide whether to count the view.

Google Analytics pageviews often drop after Reject; that gap is the consent hole, not a fault in your theme. If you run a cookieless script beside GA4, compare your own two totals for the same week. Keep GA4 if you still need it for ads. More on that choice: Cookie Free Analytics vs Google Analytics and Do I need a cookie banner for analytics?.

4. Read what the request sends

Click the pageview or event request in the Network tab and read the URL, query string and body. Note:

- whether the full page URL is sent, including query parameters that might hold emails, tokens or names;

- whether the referrer keeps its query string;

- whether a client id, session id or user id is included;

- whether extra events fire from scroll, clicks or form fields without you adding code.

Cookie Free Analytics sends a small JSON body. In the browser, the script keeps utm_source, utm_medium, utm_campaign, utm_content and utm_term and drops every other query parameter. The path is sent as-is, so personal data in the path itself is not removed. The referrer is sent without its query string. What a 1 KB analytics script actually sends lists every field.

When you read another vendor's request, write down what you actually see. Vendor pages sometimes describe a default that the snippet on the page has already extended.

5. See where the request goes

Note the hostname of the script and of the beacon. A third-party host is easy for block lists to match. A first-party host (your own domain, or a CNAME on a subdomain such as c.example.com) uses your site's name instead.

Then ask where the data is stored, and who owns the company that runs those servers. Those are two different facts:

- EU-hosted means the servers run in EU regions.

- EU-owned means the vendors themselves are European companies.

EU-hosted web analytics: beacons in Frankfurt, pageviews in Ireland is our own answer. Beacons land on functions in Frankfurt and pageviews are stored in Postgres in Ireland (eu-west-1). Vercel is a US company, so we say EU-hosted, not EU-owned.

If a vendor only says “GDPR compliant” and does not name a region or a company seat, treat that as unanswered until you find it on their site.

What these checks do not decide

These five checks tell you what the script did in your browser on that day. They are not legal advice, and they do not decide whether your site needs a cookie banner. Ad tags, embedded videos and other third-party pixels have their own rules. Your counsel still owns that call. We publish the product facts on Do I need a cookie banner for analytics? and GDPR-friendly web analytics.

They also do not tell you how two tools will count the same week on your site. Compare your own totals if you run more than one.

A script that is built to pass them

Cookie Free Analytics is a 930-byte gzipped pageview script. It sets no cookie and no localStorage id, it still counts a visit after Reject, it sends a small JSON body with a tight query allowlist, and it is EU-hosted in Frankfurt and Ireland. Hobby is free with a small link on your site. Starter removes that link from €4 a month.

See pricing, the landing page for privacy-friendly analytics without a cookie banner, and the comparisons for Plausible, Fathom, Simple Analytics, OpenPanel and Google Analytics.