Privacy First Analytics, Not Just No Cookies
I keep getting the same two searches. One is privacy first analytics. The other is privacy first web analytics. The person typing them wants a number they can look at without standing up an ads stack.
Here is the definition I actually use. Privacy first analytics collects less on purpose: no cookies by default, personal data stripped before it is stored, Do Not Track honored, and no advertising network behind the chart. Privacy first web analytics is that same job on a website. "No cookies" is one line on that list. It is not the whole list.
I built EventDash. On our own site the question is not how many people opened pricing. It is whether the person who opened pricing clicked signup. A cookieless pageview chart cannot answer that. A funnel can. The short definition lives on privacy-first analytics in the glossary. The rest of this page is the checklist I use when I am picking a tool, including the parts I will not claim.
Privacy-first checklist
Tick what you need. The verdict updates.
You want privacy-first product analytics
Cookieless pageview tools stop at traffic. EventDash is the middle: no cookies, HTML goals, and a conversion funnel without running PostHog.
Privacy first analytics vs "we turned cookies off"
I have shipped the sloppy version. You delete the cookie, then a teammate pastes a URL with an email into an event property, and the email lands in the table anyway. Or the browser sends Do Not Track and the script ignores it. Or you put the script in front of an ads network and print "privacy-first" on the homepage.
The checks that actually change the risk:
- Collect less. Only fields you open in a weekly review.
- Filter PII before storage. Names, emails, and tokens should not land in the table because someone pasted a link.
- Honor user intent. Do Not Track is a signal. I treat it as one.
- No ads sideline. The company that shows you the chart should not be selling that same visitor to advertisers.
- Keep the script small. An "11 KB" claim that quietly becomes 80 KB is still a tax on the page.
Turn cookies off and skip those five, and you have a sentence for a landing page. You do not have privacy first analytics.
What privacy first web analytics usually means
When I search privacy first web analytics, the results are mostly cookieless analytics tools that stop at pageviews: Plausible, Fathom, Simple Analytics, and the tools that sit next to them. That category is real. Visits, referrers, and a small script are the right job if the site is a blog.
They stop before the signup click. I need that click as a step, marked in HTML with data-ed-goal, not guessed from "this URL got traffic." A conversion funnel is a different product than a visit chart.
That split is why EventDash vs Plausible exists. We are the Plausible alternative when founders need the signup step. Plausible remains a traffic dashboard. If visits are all you wanted, you already have a tool.
What each tool stores
The search results blur these together. They are not the same storage.
| Tool | Cookie | On the device | The question |
|---|---|---|---|
| Plausible, Fathom | No | Nothing. A daily salt, then they drop it. | Visits and referrers |
| EventDash | No | Anonymous session id in localStorage | Which signup step died |
| GA4 | Yes, in a typical setup | Cookies, plus the ads stack | Ads and exploration |
A daily salt and a localStorage id are both called privacy first web analytics. Only one of them can keep pricing and signup in the same visit.
How this differs from GA4
I did not leave Google Analytics 4 because a thread said it was illegal. I left because I could open it every week and still not see which onboarding step killed signups. The longer version of that switch is why I left GA4. I will not retell it here.
GA4 is free, deep, and built around cookies, consent banners in a typical EU setup, and Google's advertising ecosystem. It is the ads tool. It is also the BigQuery tool. It is a heavy weekly review when the only question is a signup step.
GA4 is the wrong default for a two-person SaaS that does not run Google Ads.
PostHog is the other comparison I get. Replay, flags, experiments, a large free event quota. We are the PostHog alternative when you wanted a funnel and did not want to operate the suite.
What I actually ship
On the tracker path:
- No cookies
- PII filtering on event payloads
- Do Not Track honored
- About 11 KB gzip
- Funnels and goals without a Google Tag Manager project
The session is still an anonymous id in localStorage. MDN says that store stays until the page clears it. A cookie and that key are both written on the device. The details are in the privacy feature docs.
Free includes 100k events/month. Custom events and funnels are on Free. Error tracking, Core Web Vitals detail, Search Console, revenue by source, and exports need a paid plan. If that job is the one you have, start at signup.
The checklist I run once a quarter
- Delete events you have not opened in a month.
- Strip properties you never chart.
- Write down what is stored, and why, and share that note with the person who ships the form.
- Use a cookieless tool when ads attribution is not the job.
- If you only need visits, do not buy a product-analytics dashboard. Plausible is a fine answer for a blog.
Sources
Browser behavior for the signal we honor is documented in MDN's Do Not Track reference. The session id lives in localStorage, which stays until the page clears it. What the tracker filters, and what it still stores, is in the privacy feature docs. This article describes that product. It does not interpret privacy law.
Related
Key takeaways
- Privacy first analytics means collect less, strip personal data, honor Do Not Track, and skip the ads stack. Deleting cookies is one line, not the whole practice.
- Privacy first web analytics can still be a visit chart. If you need the signup step, you need events.
- GA4 is the ads job. Plausible is the traffic job. I use EventDash when the question is the funnel.
- We do not set cookies. The session id still sits in localStorage.
- The checklist is below. The glossary is the short definition.
FAQ
- What is privacy-first analytics?
- Privacy first analytics means you collect less on purpose. No cookies by default, names and emails stripped before storage, Do Not Track honored, and no ads network behind the chart. Deleting the cookie and keeping the ads stack is a slogan. Privacy first web analytics can still be just visits and referrers. If you need the signup step, you need events.
- Is privacy-first analytics the same as cookieless analytics?
- No. Cookieless analytics only describes the storage: no HTTP cookie. Privacy first web analytics can still be pageviews and referrers with no funnel. If you need where signup dropped, you need product events, not just a cookieless traffic widget. I use the glossary page for the short definition of cookieless analytics and this post when the question is which tool to pick.
- Do I still need a cookie banner with privacy-first analytics?
- EventDash does not set cookies. It stores an anonymous session ID in localStorage so a funnel can keep two pages in the same visit. Emails, phone numbers, and card numbers are stripped before the event is sent. Other scripts on the same page can still set cookies of their own.
- How is privacy first web analytics different from GA4?
- GA4 is built for ads attribution, consent banners in typical EU setups, and Google's advertising ecosystem. I wanted which onboarding step died, without joining that stack. EventDash is the Google Analytics alternative I use for that smaller job. It was the wrong weekly tool for a product that does not run ads.