Google Analytics Alternative: GDPR-Compliant Rybbit & Matomo

The Hidden Costs of Sticking with Google Analytics

If your website is still running Google Analytics in 2026, you are carrying more legal and technical overhead than you might realize. Multiple EU data protection authorities have already ruled that standard GA4 usage does not comply with GDPR. The cookie consent banners you rely on annoy your users and are often misconfigured as well.

We use a two-tool analytics stack: Rybbit and Matomo. It gives our clients clean, privacy-first data without a single cookie banner. This post covers the setup and why we chose it.

Why Google Analytics Is Increasingly a Liability

Google Analytics is free because you are part of the product. Every pageview, session, and click you collect feeds into Google’s advertising ecosystem. That is not speculation. That is the business model.

For European businesses, this creates a genuine legal problem. GDPR requires that personal data is not transferred to third countries without adequate safeguards. The Irish DPC, French CNIL, Austrian DSB, and Italian Garante have all found GA transfers to US servers to be non-compliant in various rulings. Even with Consent Mode v2, you are adding complexity, accepting modeled rather than real conversion data, and still depending on a platform that profits from your users’ behavior.

Beyond the legal angle, GA4 itself is simply hard to use. The interface requires significant training. Reports are scattered across dozens of views. Data sampling on the free tier means your dashboards might not reflect reality at scale.

Google Analytics is increasingly difficult to justify from a legal, ethical, and practical perspective, especially in the EU.

Our Two-Tool Approach: Rybbit and Matomo

Rather than searching for one tool that tries to do everything, we match the tool to the client’s actual need.

Rybbit: The Modern, Cookieless Layer

Rybbit is an open-source, cookieless web analytics platform built on a modern TypeScript and ClickHouse stack. It launched in early 2025 and has grown to over 12,000 GitHub stars and 4,000+ organizations in under two years. That tells you something about how badly the market needed it.

What Makes Rybbit Different

Rybbit sets no persistent identifiers and no cookies, so GDPR and CCPA compliance is the default rather than something you bolt on afterwards. Visitors never see a cookie banner, because there is nothing to consent to.

The dashboard fits on one screen: sessions, unique visitors, bounce rate, top pages, traffic sources, geographic breakdown, and device data. No hunting through nested reports.

Session replays let you watch real users move around the site, find where they drop out of a funnel, and trace the path from landing page to conversion, without identifying anyone.

The tracking snippet is about 1KB, small enough that it will not drag down your Core Web Vitals.

You can deploy Rybbit on your own VPS via Docker Compose for full data sovereignty, or use the hosted version, whose free tier covers 3,000 pageviews per month with no credit card required.

How We Use Rybbit for Clients

For most of our clients, especially smaller businesses, startups, and content-driven sites, Rybbit is the primary analytics layer. We configure it to track:

• Custom events for form submissions, CTA clicks, and other key interactions
• Conversion funnels, so drop-off points in a checkout or signup flow are visible
• Session replays, which surface UX friction that numbers alone will not show you
• Real-time traffic during campaigns and product launches
• Web Vitals, as part of ongoing performance monitoring

Setup takes one script tag. We can onboard a new client site in under 30 minutes, and because the dashboard is self-explanatory, clients log in on their own and read their own numbers without a walkthrough from us.

Rybbit’s session replay feature has changed how we do conversion rate optimization. Showing a client a three-minute session replay of a confused user is worth ten pages of analytics reports.

Rybbit Installation Code

<!-- Rybbit: One-line install -->
<script
  src="https://app.rybbit.com/api/script.js"
  data-site-id="YOUR_SITE_ID"
  defer
></script>

Matomo: The Power Layer for Complex Needs

Matomo (formerly Piwik) has been around since 2007 and is the most feature-complete open-source analytics platform available. We use it for clients who need enterprise-grade depth: e-commerce tracking, heatmaps, A/B testing, advanced segmentation, and long-term data retention.

What Matomo Excels At

Self-hosted, all data lives on your server and no third party ever has access. For clients in healthcare, finance, or legal, that is not a preference.

The WooCommerce and custom e-commerce integrations track revenue, cart abandonment, and product performance in more depth than GA4’s enhanced e-commerce.

Heatmaps and form analytics arrive as plugins and show where users click, how far they scroll, and where they abandon a form, with nothing sent to an external service.

Segmentation is granular enough to build audience cohorts and compare how each one behaves over time, which is how clients find out why one segment converts and another does not.

Matomo never samples. You see every session, which matters on smaller sites where a sampled report would be statistically meaningless.

Built-in tooling covers cookie consent, data anonymization, and right-to-erasure requests, so documented compliance workflows have somewhere to live. The 1-Click CNIL compliance feature added in April 2026 simplifies the French side.

How We Use Matomo for Clients

We deploy Matomo where the complexity earns its keep, typically for:

• E-commerce businesses that need revenue attribution and product funnel analysis
• Enterprise or regulated clients with data sovereignty and audit trail requirements
• Multi-site organizations that need one place to see reporting across web properties
• Clients migrating from GA4 who want to import historical data and keep a familiar reporting structure

We self-host Matomo on dedicated infrastructure, so there are no per-hit cloud pricing surprises. The PHP and MySQL stack is mature and runs reliably on modest servers.

Matomo Installation Code (Self-Hosted)

<!-- Matomo: Self-hosted install -->
<script>
  var _paq = (window._paq = window._paq || []);
  _paq.push(["trackPageView"]);
  _paq.push(["enableLinkTracking"]);
  (function () {
    var u = "https://analytics.yourdomain.com/";
    _paq.push(["setTrackerUrl", u + "matomo.php"]);
    _paq.push(["setSiteId", "1"]);
    var d = document,
      g = d.createElement("script"),
      s = d.getElementsByTagName("script")[0];
    g.async = true;
    g.src = u + "matomo.js";
    s.parentNode.insertBefore(g, s);
  })();
</script>

Rybbit vs Matomo: How We Choose

The decision matrix we work from:

Rybbit is our default. We reach for Matomo when a client’s use case actually requires the additional depth.

Migrating from GA4: A Practical Four-Step Process

1. Audit your current GA4 setup: Export key reports, note custom dimensions and events
2. Install Rybbit or Matomo alongside GA4: Run both tools in parallel for two to four weeks to validate data
3. Map GA4 events to the new tool: Use Rybbit’s custom events or Matomo’s event tracking
4. Switch reporting and sunset GA4: Update dashboards, train your team, remove the GA4 snippet

Archive your GA4 exports before you start. Neither Rybbit nor Matomo can import GA4 historical data, so PDF exports are the only record you will have of the period before the switch.

The GDPR Case for Cookieless Analytics

Every European client eventually asks whether their analytics setup is compliant. Both tools let us answer yes.

Rybbit collects no personal data and sets no cookies, so GDPR’s consent requirements are never triggered in the first place. Matomo, self-hosted and configured properly, keeps the data on your own infrastructure.

Google Analytics needs a different kind of answer, one involving Consent Mode, server-side tagging, a data processing agreement, US data transfers, and whatever the next DPA ruling changes. We would rather not reopen that conversation with clients every six months.

Note for EU businesses: Several EU data protection authorities have issued decisions finding standard Google Analytics implementations non-compliant with GDPR. If you are serving European users, cookieless alternatives are worth evaluating seriously: not as an ethical preference, but as a legal one.

What Clients Actually See Improve

Cookieless tracking also tends to produce better numbers than GA4, for two reasons.

Consent banners depress opt-in rates, sometimes sharply. When a meaningful share of visitors reject analytics cookies, every decision downstream rests on a systematically biased sample, and the people who opted in may behave nothing like the people who did not. Cookieless tracking counts everyone.

Ad blockers are the other factor. Plenty of them block Google Analytics by default, while a first-party script this light is far less likely to be filtered, so session counts land closer to the truth.

Getting Started

• rybbit.io has a free tier of 3,000 pageviews per month, no credit card required, and you can self-host with Docker.
• matomo.org offers a self-hosted open-source version, which is free, plus a managed cloud option.

Our GDPR checklist before launch lists some items to check before you go live.

If you would rather not configure either tool yourself, we take on the setup, custom event tracking, funnel design, and ongoing maintenance. Tell us what you are running and we will tell you honestly whether you need Rybbit, Matomo, or neither.