Is Google Analytics GDPR-compliant? My answer: Umami

🇫🇷 Lire en français : Google Analytics est-il conforme au RGPD ? Mon choix : Umami

I replaced Google Analytics with Umami, an open source, cookie-free, self-hosted audience measurement tool. The reason comes down to one figure: behind a compliant consent banner, roughly 40 to 45 % of visits never appear in GA4. And the AI reconstruction Google offers in compensation never switches on for a human-sized local site. Umami measures 100 % of traffic, legally, with a script under 2 KB.

Key points

• Between refusals and non-answers, roughly 40 to 45 % of traffic escapes Google Analytics behind a compliant banner.
• Google’s AI modelling requires 1,000 consenting users per day: a local professional site will never switch it on.
• Umami measures 100 % of traffic, with no cookie and no banner, using a script under 2 KB, with data hosted at your place.
• Below 2,000 visitors a day, GA4 cannot work the way it is meant to. Above it, its estimates are still extrapolated from outside markets: in a local micro-market, Umami remains the right call, unless you are running Google Ads campaigns.

Below 2,000 visitors a day, GA4 will never see your traffic in full. Above it, it reconstructs that traffic from markets that are not yours. Either way, unless you are running Google Ads, my advice is the same: measure on your own infrastructure, and steer campaigns rather than individuals.

— Olivier Watte, known as Oliver · founder of Kimoun

What is Umami?  

Umami is an open source web analytics platform, created in 2020 by Mike Cao. It counts visits, page views, sources, campaigns and custom events, without cookies, without fingerprinting, without collecting personal data. The script weighs under 2 KB, where the Google Tag Manager plus GA4 pairing routinely exceeds 100 KB.

Umami installs on your own server (Docker, a few minutes) or runs through the publisher’s cloud offer. On the infrastructures we manage, it is part of the stack shipped with managed hosting. In the first case, visit data never leaves your infrastructure.

How much data does a consent banner cost you?  

  Tip

With a compliant banner, a large share of visitors escapes Google Analytics: those who refuse, plus those who ignore the banner entirely.

Two populations escape GA4, and they add up. First, those who explicitly refuse. The CNIL, which tracks the effect of its action plan on banners, finds that refusal rates have risen markedly since a “Reject” button became mandatory and had to be as accessible as “Accept”. Second, and this is the group everyone forgets, those who answer nothing at all: the Didomi 2026 benchmark puts that non-answer rate between 21 and 27 % depending on the European region. With no explicit choice, no consent-bound tracker may be set.

Adding refusals and non-answers together, you land reasonably in a range of 40 to 45 % of traffic invisible to GA4. Published measurements vary by sector, by country and by counting method, and I prefer to keep a conservative estimate: it is more than enough for the argument. A tool that misses two visitors out of five is not a steering tool.

  Note

On the sites we monitor in Guadeloupe, GA4 sees only around one Google click in three of those reported by Search Console, and daily event volume stays one to two orders of magnitude below Google’s modelling threshold.

Why AI modelling does not rescue small sites  

  Tip

GA4’s behavioural modelling requires 1,000 refused events a day for 7 days: a local site rarely reaches that threshold.

Google knows the problem and offers an answer: Consent Mode v2 and its “behavioural modelling”. An AI estimates what non-consenting visitors would probably have done, based on the behaviour of those who accepted. On paper, the holes fill themselves in.

In practice, two locks shut local sites out. The first lock is the thresholds. Google requires at least 1,000 events a day with consent denied over 7 consecutive days, plus 1,000 consenting users a day on 7 of the last 28 days. A well-ranked Guadeloupean professional site sits one or two orders of magnitude below that: modelling will never activate, and its reports stay truncated.

The second lock is bias. The model extrapolates from visitors who accept cookies and from global behavioural datasets. Nothing guarantees they resemble local traffic, small in volume but highly qualified. And GA4 mixes observed and predicted data in the same reports, without telling you which is which. One more awkward detail: modelling requires the “advanced” mode of Consent Mode, in which Google tags load before consent and send anonymised signals even after a refusal, a mechanism legally contested in France.

What Umami changes in practice  

Umami reverses the equation: instead of modelling what you are not allowed to measure, you measure what you are allowed to measure, which is everything, anonymously. With no cookie and no personal data, audience measurement falls within the consent exemption framework set out by the CNIL: the banner becomes unnecessary for plain visit statistics.

The gain is threefold. Complete data: 100 % of observed traffic. Measured data rather than modelled data: an Umami figure is a fact, not an estimate from an AI trained elsewhere. Data at home: the database runs on your server, reversible, exportable, out of reach of the Cloud Act. It is the same logic I defend for company data facing AI agents and that SovereigntyMap measures.

Is Google Analytics still GDPR-compliant?  

The question that always follows: “is GA4 still legal?” The fair answer is nuanced. In 2022 the CNIL ruled that the then-common configuration of Google Analytics was incompatible with the GDPR, because of data transfers to the United States. The legal framework has evolved since, and compliant configurations exist. GA4 is not banned.

But two constraints remain, and they are structural. GA4 sets cookies: prior consent stays mandatory, with the measurement losses described above. And the CNIL regularly penalises non-compliant banners, up to 325 million euros against Google in September 2025. Put plainly, the more honest your banner, the fewer people GA4 sees. Umami has no such dilemma: it has nothing to get accepted.

Anonymity also changes how you do marketing  

The classic objection: “without individual tracking, how do I optimise?” My own experience: anonymisation pushes you towards steering by campaign rather than by visitor. You stop asking what visitor number 4832 did, and start comparing what each action produces: this LinkedIn post, that QR code on a flyer, that WhatsApp campaign, through UTM parameters and Umami’s aggregated events.

For a local site with qualified traffic, that level of aggregation is more than enough to decide: which source brings quote requests, which page converts, which campaign deserves a second run.

How I migrated kimoun.com  

The migration comes down to four steps: export the GA4 reports worth keeping, deploy Umami on my infrastructure, add the script and the events (CTA clicks, WhatsApp, quote requests), then remove GA4 from the default page load. The consent banner no longer gates audience measurement: it will only come back when a consent-bound tracker actually runs.

  Warning

If you have live Google Ads campaigns, do not cut GA4 abruptly: advertising conversion tracking has to be rewired properly first. That is the subject of a forthcoming article: switching GA4 on only while campaigns run, wired to the same Umami events, with the full switchover procedure.

Who I recommend Umami to, rather than GA4  

  Tip

The 2,000 visitors a day threshold is not a border between two tools: it is the point where GA4 merely starts working the way it is meant to.

The threshold I gave at the top of this article, 2,000 visitors a day, is not arbitrary: it follows from Google’s own conditions. Modelling requires 1,000 consenting users a day; with an acceptance rate of roughly 55 to 60 %, you therefore need something like 2,000 daily visitors to have any hope of switching it on. Below that, GA4 is structurally truncated, and in Guadeloupe the vast majority of professional sites sit below it. For them the question settles quickly: keeping GA4 is a bad idea.

Above the threshold, the answer takes more nuance, and it does not go the way you might expect. Modelling switches on, reconstructed data is indeed produced, but it is extrapolated from outside markets: different behaviours, a different scale, a different relationship to local trade. In a micro-market like the Caribbean, those estimates do not describe your visitors, they describe an average that resembles them only from a distance, and the bias I mentioned earlier does not vanish with volume: it simply becomes invisible, buried in reports that never separate the observed from the predicted. Unless you are running Google Ads, where the GA4 brick becomes necessary again, it is a false good idea.

In other words, the choice is not between a rich tool and a poor one. It is between partial measurement dressed up with estimates borrowed from elsewhere, and complete measurement, owned outright. So my advice is the same on both sides of the threshold: pick something like Umami, and move your marketing towards campaign strategies rather than tracking individuals. It is more ethical, and in a local market it is above all more effective.