Cookie-based analytics is bleeding data. According to SealMetrics (2025), websites running cookie-dependent analytics tools lose 80-90% of their visitor data in EU markets. Visitors either ghost the consent banner entirely, actively reject cookies, or browse with ad blockers that strip tracking scripts on arrival. Meanwhile, EU regulators levied EUR 1.2 billion in GDPR fines in 2025 alone — and Google itself was hit with a EUR 325 million penalty from France's CNIL for Gmail ads and invalid cookie consent.
So what's the alternative? Privacy-first analytics tools promise accurate data without cookies, consent banners, or legal risk. But how do they actually compare? We put four tools — Pulse, Google Analytics, Plausible, and Fathom — through a side-by-side comparison on privacy compliance, script performance, data accuracy, and total cost of ownership.
Updated 18 October 2026: Pulse's plans are Personal (free) and Business, so the pricing section links to the pricing page. We also re-measured the script sizes, removed the version-pinned script, and corrected what Pulse's tracker stores and what is open source.
Update, 19-07-2026 — This post has been corrected in three places: we previously (and wrongly) credited Fathom Analytics with SOC 2 and ISO 27001 certification — that's a different company, the AI meeting notetaker at fathomhq.com. We've replaced that with Fathom's actual strengths below. The Cologne court date and case citation were wrong and are now fixed. And every price in this post has been updated to current, July 2026 tiers.
How Much Data Are Cookie-Based Analytics Actually Losing?
A 2025 SealMetrics study found that cookie-based analytics loses 80-90% of total visitor data in European markets. The loss happens in three stages: 40-60% of visitors never interact with the consent banner at all (they "ghost" it), another 25-35% actively click reject, and only 10-20% actually accept cookies and get tracked. In Germany, the worst case, fewer than 10% of visitors are tracked.
That's not a minor gap in your data. It's a chasm. You're making product decisions based on the behavior of the 10-20% of visitors who happened to click "Accept." Are those visitors representative of your entire audience? Almost certainly not. Cookie acceptors tend to be less privacy-conscious, less technical, and less likely to use ad blockers — which means your analytics paints a systematically skewed picture. The picture looks different in the United States, where cookie acceptance rates exceed 80% (CookieYes, 2026). But if you serve any European traffic — and most websites do — the data loss is severe. Privacy-first analytics tools sidestep this problem entirely by not using cookies in the first place. Every visitor gets counted, regardless of whether they interact with a banner.
Privacy Compliance: Who Passes the GDPR Test?
EU regulators issued EUR 1.2 billion in GDPR fines in 2025, and DLA Piper's cumulative tally since 2018 reached EUR 7.1 billion through 10 January 2026. Google was directly targeted: France's CNIL fined Google EUR 325 million on 1 September 2025 for Gmail ads and invalid cookie consent, and the Cologne Regional Court (LG Köln) ruled on 23 March 2023 that transferring personal data to the US without Schrems II-adequate safeguards violates GDPR (case 33 O 376/22, against Deutsche Telekom) — a precedent with direct bearing on GA's US data flows. These aren't hypothetical risks. They're active enforcement actions against an analytics tool installed on tens of millions of websites (W3Techs). If you're weighing your own exposure, we cover the two questions that sit underneath these fines in depth: whether your analytics actually needs a cookie banner, and what GDPR compliance really requires.
So how do the four tools compare on privacy compliance? The differences are stark.
| Feature | Pulse | Google Analytics | Plausible | Fathom |
|---|---|---|---|---|
| Cookie-free | Yes | No | Yes | Yes |
| Designed to need no consent banner | Yes | No | Yes | Yes |
| Open source | Client + script (AGPL-3.0) | No | Yes | No |
| Data residency | Switzerland (FADP) | No | Yes (Germany) | EU isolation (EU visitors only) |
| No data sampling | Yes | No | Yes | Yes |
| Self-hostable | No | No | Yes | No |
| Score | 5/6 | 0/6 | 6/6 | 4/6 |
Pulse
Google Analytics
Plausible
FathomPulse, Plausible, and Fathom are all built to minimise the personal data they collect, and the site operator still makes the GDPR determination for their own setup. Google Analytics requires explicit cookie consent under GDPR, extensive configuration to approach compliance, and still transfers data to US servers by default. Pulse differentiates itself with Swiss data residency under the FADP — Switzerland isn't in the EU, but the FADP provides equivalent protection and the data is stored in Exoscale's Zurich datacenter rather than in a US cloud — plus a fully open-source client and tracking script. Plausible leads on self-hosting capability, running on German infrastructure by default. Fathom isolates EU visitor data to servers inside the EU but isn't open source.
With 172 countries now having data privacy laws (up from 120 in 2017), GDPR compliance isn't just a European concern. It's becoming the global baseline. Picking an analytics tool that's compliant by design saves you from playing legal whack-a-mole as new regulations appear.
How Does Script Size Affect Page Speed?
We measured all four with curl on 18 October 2026. Google Analytics' gtag.js is many times larger than the other three, and its exact size varies by property. Plausible's script is about 1.3 KB gzipped, Fathom's is about 2 KB, and Pulse's is under 3 KB.
Pulse is the largest of the three privacy-first scripts, and we'd rather say so than round in our own favour. At this scale the gap between them is noise: a visitor will not feel it. The gap that does matter is Google Analytics, whose script is many times heavier than any of the three.
Does that gap matter in practice? On mobile connections, every kilobyte adds to Time to Interactive, and a script that runs before the page paints can also fail, mis-fire, or get blocked by an ad blocker mid-load. A script of a few kilobytes removes most of that failure surface.
Here's a receipt you can partly check yourself instead of taking a vendor's word for it: Pulse builds a salted SHA-256 session hash that resets every day at the site's midnight, and a visitor hash that resets on the site's identity window, a calendar month by default (owners can shorten it to 24 hours, 7 days, 30 days or session only). A returning reader counts once within the window, and nothing links a reader across sites or across windows. The raw IP address is discarded immediately after hashing — never written to disk or logs. There's no cookie. The tracker keeps two short-lived values in the tab's session storage (ciphera_anchor, the id of the latest pageview, sent back to the server as anchor_id; ciphera_last_pv, a refresh guard) and reads one local-storage flag, pulse_ignore, which a site owner sets by opening a ?pulse-ignore link. None of it is a fingerprint cache. The client and script are open source, and the tracker served from js.ciphera.net is byte-identical to the one in the public repository, so what the script does in your browser is something you can read. The backend that does the hashing runs as a managed service and is not public.
Data Accuracy: Sampling vs Full Counts
Google Analytics applies data sampling when explorations exceed 10 million events (Google Support). Once sampling kicks in, GA4 extrapolates from a subset of your data rather than counting every event. Want unsampled reports? That requires GA 360, which starts at roughly $50,000 per year. For most businesses, that means living with sampled data and hoping the extrapolations are accurate enough.
Pulse, Plausible, and Fathom don't sample. Every pageview is counted, every referrer is recorded, and every metric you see in the dashboard reflects your actual traffic — not a statistical estimate. This isn't just a technical distinction. When your VP of marketing asks why last month's traffic looks different from the board deck, "Google was sampling our data" is not a confidence-inspiring answer.
The privacy-enhancing technologies market reflects this shift. Grand View Research values it at $3.1 billion in 2024, projecting growth to $12 billion by 2030 at a 25.3% CAGR. Businesses aren't just adopting privacy tools for compliance. They're adopting them because the alternatives — sampled data, consent banner friction, legal exposure — are worse in every measurable way.
What Does Each Dashboard Actually Show You?
Your analytics tool choice isn't invisible to your users. A consent banner asking to track them across the web shapes how visitors perceive your brand before they've read a word of your content — and a large share of them respond by ghosting the banner entirely, per the SealMetrics numbers above.
But what do you actually lose by switching from GA to a privacy-first alternative? Less than you'd think. Here's what each tool offers:
- Google Analytics: Page views, sessions, user journeys, conversion funnels, audience demographics, event tracking, cross-site tracking, remarketing audiences, attribution modeling. Requires cookie consent and complex setup.
- Plausible: Page views, unique visitors, bounce rate, visit duration, referrer sources, countries, devices, browsers, UTM tracking, custom events, goals. No cookies, 1.3 KB script.
- Fathom: Page views, unique visitors, referrers, countries, devices, browsers, UTM tracking, custom events, uptime monitoring included. No cookies, EU visitor isolation.
- Pulse: Page views, unique visitors, bounce rate, session duration, referrer sources, countries, devices, browsers, UTM tracking, aggregate user journeys with a Sankey flow view, funnels (up to 8 steps), automatic 404 detection, page rules for grouping or excluding paths, a Google Search Console integration on every plan including free, a 75-integration directory, and a BunnyCDN integration. No cookies, open-source client and script, data stored in Switzerland.
What you won't get from any privacy-first tool: session recordings, cross-site behavioral profiles, or remarketing audiences. Plausible and Fathom give you no person-level user journey either. Pulse has one, but it is off by default: an owner can switch on a Visitors view that lists pseudonymous readers and their visits inside the site's identity window (a calendar month by default), never beyond it and never on share links, the public API or exports. Pulse's Sankey flow view and funnels get you most of the way there anyway: they show how visitors as a group move through your site and where they drop off, and the dashboard shows only these aggregates unless an owner switches the Visitors view on. That's not a gap in the privacy-first category — it's the trade-off that makes the rest of this comparison possible. The real question is whether you use person-level journey replay to make product decisions, or whether you mainly look at traffic trends, top pages, referrer sources, and drop-off points. Most teams operate on the latter, which is exactly what aggregate journeys give you.
Pricing and the True Cost of "Free" Analytics
Google Analytics is free. But is it actually free? If you serve EU users, you need a consent management platform (CMP) to comply with GDPR's cookie consent requirements. CMPs like Cookiebot, OneTrust, or CookieYes cost $100-500 per month depending on traffic. Add legal review time for your privacy policy, DPA negotiations, and the ongoing risk of regulatory fines, and "free" starts looking expensive.
Pulse's free tier covers 1 site, 5,000 pageviews/month, and 6-month data retention — enough for a small site or a side project, but most production traffic outgrows it fast. The paid Business plan covers up to 5 sites, with pageview-based tiers and two-year retention. Current prices are on the pricing page. The Pulse site also has side-by-side comparisons with Plausible, Fathom and Google Analytics.
| Tool | Monthly Cost at 100K Pageviews | Notes |
|---|---|---|
| Pulse | Business plan (see the pricing page) | Free tier caps at 5,000 pageviews/mo; designed to need no CMP or consent banner; DPA available on request |
| Google Analytics | $0* | *Plus $100-500/mo for consent management (CMP) |
| Plausible | $19/mo | Starts at $9/mo for 10K pageviews |
| Fathom | from ~$15/mo | No free tier, as of July 2026 |
At higher volumes, the gap holds. GA4's free tier samples data above 10 million events; unsampled data requires GA 360, which starts at roughly $50,000/year. Plausible scales to $69/month at 1 million pageviews, and Fathom runs around $45/month at 500K pageviews (as of July 2026) — both with full, unsampled data at every tier. The three privacy-first tools are designed to need no CMP on top of the sticker price, which means, unlike GA, the sticker price is close to the real price. A Data Processing Agreement for Pulse is available on request.
Which Tool Should You Choose?
There isn't one right answer for every team. Here's a decision framework based on what matters most to you:
- You need the cheapest compliant option for a small site: Pulse. The free tier (1 site, 5,000 pageviews/month) covers the core metrics, with no cookies and a tracker designed to need no consent banner, and the Business plan (up to 5 sites) scales by pageview tier, with current prices on the pricing page. Because the tracker is open source, you can check what it does in your visitors' browsers.
- You want self-hosting control: Plausible. It's the only tool here that lets you run the full stack on your own infrastructure, which is a strong advantage for organizations with strict data residency requirements.
- You want a simple, no-frills dashboard with uptime monitoring built in: Fathom. It isolates EU visitor data to EU servers and bundles uptime monitoring into the same subscription — a clean option if you don't need self-hosting or an open-source codebase.
- You need advertising integrations and remarketing: Google Analytics. If your business model depends on Google Ads, retargeting audiences, and attribution modeling, GA is still the tool for you — just budget for consent management and legal review.
- You're an EU-focused business that values data sovereignty: Pulse. Swiss data residency under the FADP, combined with a zero-cookie architecture, gives you a strong legal position on this list. Companies that treat privacy as an afterthought end up paying for it — in fines, in trust, and in churn.
The Bottom Line
Google Analytics remains powerful, but it carries growing legal risk, loses the majority of EU visitor data to consent rejection, samples data above modest thresholds, and ships a script many times heavier than Pulse's, Plausible's or Fathom's. Pulse, Plausible, and Fathom each offer a genuine alternative with different strengths:
- Pulse: Free tier (5,000 pageviews/mo), open-source client and script (AGPL-3.0), Swiss data residency (FADP), script under 3 KB gzipped
- Plausible: Self-hostable, 1.3 KB script, German data residency, 19,000+ paying subscribers
- Fathom: EU visitor isolation, included uptime monitoring, simple dashboard
The privacy-first analytics market is growing at 25.3% CAGR for a reason. Businesses are realizing that accurate, compliant analytics doesn't require tracking individual users across the web — and the receipts here, from script weight to data residency to open-source code, hold up to scrutiny in a way "trust us" tracking scripts don't.