A GDPR-compliant alternative to Google Analytics

Most teams that measure their website’s audience do so with Google Analytics, often out of habit rather than deliberate choice. The tool is free, ubiquitous, and takes only minutes to set up. But for several years now, its use in Europe has raised a question that is anything but trivial: is it even legal? The answer, as it emerges from the decisions of data protection authorities, is nuanced but consequential. Here we propose to understand where the problem comes from, what you actually lose by leaving Google Analytics, and what an approach designed without cookies or profiling brings instead.

Where the compliance problem comes from

The heart of the matter is not the technical quality of Google Analytics, but the journey taken by the data it collects. When a European visitor browses a site equipped with the tool, part of the information about them is transferred to servers subject to US law. Yet European law strictly governs such transfers: personal data may only leave the Union for countries offering a level of protection equivalent to the GDPR’s.

In July 2020, the Court of Justice of the European Union handed down the so-called Schrems II ruling, which invalidated the Privacy Shield, the agreement that until then governed data transfers between Europe and the United States. The Court held that US surveillance programs did not guarantee Europeans sufficient protection of their data. This decision left a legal vacuum for a great many tools hosted across the Atlantic.

In its wake, several European data protection authorities received complaints aimed directly at Google Analytics. In 2022, France’s CNIL issued formal notices to several website operators, holding that the use of Google Analytics, under its terms at the time, was not GDPR-compliant precisely because of these transfers. The Austrian and Italian authorities issued decisions along the same lines. The message was clear: this is not a question of marginal configuration, but a fundamental problem tied to the very architecture of the tool.

What consent does not really solve

Faced with these difficulties, the most widespread response has been to pile on consent banners. The idea seems logical: if the visitor accepts cookies and collection, the processing becomes lawful. In practice, this solution shifts the problem more than it resolves it.

First, consent does not cover everything. The question of transfers to the United States remains open even when the person has clicked “Accept,” because a visitor cannot validly consent to a transfer that fails to offer them the guarantees provided by the GDPR. Second, the banner degrades the experience: it slows display, clutters the first impression, and forces every visitor into an action before they have even read the page.

Finally, and this is often underestimated, consent distorts the measurement itself. A significant share of visitors refuse cookies or close the banner without answering. The resulting statistics then cover only a fraction of the audience, with biases that are hard to correct. You end up making decisions on partial data while bearing the regulatory burden of a tracking system. It is the worst of both worlds: less reliable and more risky.

What you lose, and what you don’t

The most common fear, when leaving Google Analytics, is losing analytical depth. Let us be honest: you do lose some things. Advertising remarketing features, audiences exported to ad networks, tracking the same individual across multiple sessions and multiple sites — everything that amounts to profiling disappears. But these features are precisely the ones that pose a problem under the GDPR, and many teams never really use them.

On the other hand, you do not lose the essentials of audience measurement. The number of visits, the most viewed pages, traffic sources, the breakdown by device or country, trends over time: all of this remains perfectly accessible with a privacy-respecting approach. These are the indicators on which the vast majority of editorial and product decisions rest. Migrating therefore does not mean giving up understanding your audience, but ceasing to track them individually.

There is even a gain in clarity. By abandoning profiling, you focus on aggregate metrics, simpler to interpret and less prone to artifacts. The dashboard stops being a contraption and goes back to being a decision-making tool.

What measurement without cookies or profiling brings

Analytics designed for privacy reverses the original logic: instead of collecting the maximum and then trying to become compliant, it collects only what is necessary for audience measurement. It is this reversal that changes everything.

First, compliance by default. By placing no tracking cookie and reconstructing no advertising profile, you step outside the scope that requires a consent banner for this type of tracker. Measurement becomes a technical function of the site, not a risky processing operation you try to justify after the fact. At Takt, this is the principle we chose from the outset: measuring a site’s audience without ever tracking the person who visits it.

Second, faster, leaner pages. A lightweight script, without a battery of cookies or calls to third-party ad networks, lightens loading and reduces the surface of external dependencies. The visitor lands directly on the content, with no interstitial or delay.

Finally, measurement that is not distorted by consent refusals. Since there is no banner to accept for aggregate, anonymous measurement, the statistics cover all traffic, not just the fraction of visitors who clicked “Accept.” Paradoxically, by collecting less individual data, you get a truer picture of your real audience.

In summary

Google Analytics’s problem in Europe is not a technical detail: it stems from the data-transfer architecture invalidated by the Schrems II ruling and confirmed by the CNIL’s formal notices in 2022. Piling on consent banners solves neither the legal question nor the reliability of the measurements. Migrating to analytics without cookies or profiling means losing advertising-profiling features — the very ones that pose a problem — but preserves the essentials: understanding your audience, your pages, your traffic sources. You gain compliance by default, lighter pages, and figures that genuinely reflect all your visitors. For many sites, it is a better trade-off than trying to make acceptable a tool that no longer is.