Yes, there is a way to track your website visitors without Google Analytics, and the data you get back is often cleaner. Privacy-first analytics tools collect the same core metrics (traffic volume, referral sources, top pages, bounce rate) without planting a tracking cookie in every visitor's browser. That means no cookie consent banner, no liability for sending session data to third-party servers, and no consent-mode gaps distorting your reports.
This post is part of the website foundation guide we built to cover the operational layer that sits under a service business's public site. Analytics is infrastructure. Getting it wrong creates both a compliance exposure and a data quality problem.
What is actually wrong with using Google Analytics?
Google Analytics 4 is free software that funds itself by enriching Google's advertising data with behavioral signals from your visitors. The tool works fine as a product. The problem is operational: GA4 transfers every session record to Google's servers, and that transfer qualifies as personal data processing under GDPR and, depending on the visitor's state, under CCPA.
In practice, most small business websites running GA4 are doing so without a GDPR-compliant consent mechanism. The cookie consent banner you see on large corporate sites exists specifically to collect explicit permission before that data transfer happens. Many small business web designers skip the banner entirely, either because they do not know it is required or because implementing it correctly (with proper consent mode integration) is genuinely complicated.
A chiropractor we worked with had this exact situation. His attorney flagged the GA4 setup during a routine compliance review: patient session data (including appointment-related page visits) was flowing to Google servers with no consent mechanism in place. His original web designer had never mentioned it. The fix was not a legal filing or a data incident response. It was replacing the analytics tool.
Beyond the compliance angle, there is a data quality problem. GA4's consent mode, when configured correctly, models the traffic it cannot measure because visitors declined consent. Modeled data is better than nothing, but it introduces estimates into your funnel reports. You end up with numbers you can not fully trust.
What does privacy-first analytics actually mean?
Privacy-first analytics tools collect visitor data at the aggregate level without relying on cookies or individual user profiles. Instead of tagging each browser with a tracking identifier, they derive metrics from server-side signals (IP address anonymization, referrer headers, page paths) and aggregate them before any storage occurs. No profile is built on any individual visitor.
The two tools we use and recommend most often are Plausible Analytics and Fathom Analytics. Both are purpose-built to be cookieless. Both have been reviewed by European data protection authorities and confirmed to operate without requiring consent under ePrivacy rules. The operational win is immediate: you drop the cookie banner entirely, which removes a friction point from your site and eliminates the consent-mode complexity from your reporting stack.
The metrics you get are the same ones that matter for a service business: total visits, unique visitors, pageviews by URL, bounce rate, session duration, traffic sources (organic search, direct, referral, social), and device breakdown. You can also track goal completions (form submissions, button clicks, phone number taps) with a small amount of configuration.
Will my traffic numbers look different after switching?
Almost certainly yes, and usually higher. Google Analytics is blocked by a large share of modern browsers and browser extensions. Firefox Enhanced Tracking Protection blocks GA by default. Safari's Intelligent Tracking Prevention limits what GA can record. Ad blockers running on desktop (a significant portion of web traffic in general) filter GA's script before it even fires.
Cookieless tools do not rely on JavaScript that gets filtered at the browser level in the same way. When we migrated a client from GA4 to a cookieless analytics tool, two things happened: the cookie consent banner disappeared and their reported traffic increased because the new tool captures visitors who block Google scripts. The conversion funnel data also became cleaner because there were no bot sessions inflating pageview counts.
The increase is not a sign that the new tool is inflating numbers. It is a sign that GA4 was undercounting. The new baseline is closer to your actual traffic. Your Core Web Vitals scores will show in Google Search Console regardless of what analytics tool you use, so you are not losing any technical site data by switching.
Share of desktop users running ad blockers that filter Google Analytics scripts before they fire, meaning GA4 undercounts a meaningful slice of real traffic.
How do you actually set this up?
Setup is simpler than GA4. You create an account with Plausible or Fathom, add your domain, and drop a single script tag into your site's HTML. There is no tag manager required, no data stream configuration, no consent mode to configure. The script is small (Plausible's is under 1kb), which means it adds no meaningful weight to your page load.
For a static HTML site (like the sites we build), you paste one line in the <head>. For WordPress, there are official plugins. For most website builders, there is a "custom code" or "header scripts" field where the tag goes. The whole process takes about ten minutes.
Goal tracking (measuring form submissions or button clicks) requires a small amount of additional configuration. Both Plausible and Fathom offer event tracking via a JavaScript API that lets you fire a named event when a visitor completes a specific action. If your site has a contact form, you wire the "thank you" redirect to trigger an event. You do not need a developer for this in most cases, but if the goal matters to your business (and form submissions do matter), it is worth having someone set it up correctly so the data is reliable from day one.
On the reporting side, both tools give you a single clean dashboard. No configuration of custom reports, no trying to rebuild what Universal Analytics used to show. The default view covers everything a service business needs: traffic volume, top pages, traffic sources, and goal completions, all in one screen you can check in two minutes.
What about Google Search Console? Should I keep that?
Yes, keep Google Search Console. It is a separate product from Google Analytics and it serves a different purpose. Search Console shows you which search queries are driving impressions and clicks to your site, your average position in search results, and any crawl or indexing issues Google has flagged. None of that data flows to the advertising network the way GA4 session data does.
The setup that works well for most service businesses: Plausible or Fathom for on-site behavior (traffic, pages, goals), Google Search Console for search performance data, and nothing else. You do not need GA4, you do not need a tag manager, and you do not need a third analytics tool on top. For understanding why your business is not showing up in search, Search Console gives you more useful data than GA4 ever did for most service businesses anyway.
How much does this cost compared to Google Analytics?
Google Analytics is free to use. Plausible starts at $9 per month for up to 10,000 monthly pageviews. Fathom starts at $15 per month. For a service business site with typical traffic, $9 to $15 a month is the real cost of switching.
The comparison that matters is not "free vs. $9." It is "$9 per month vs. the cost of configuring GA4's consent mode correctly, monitoring ongoing GDPR compliance, and handling whatever your attorney says when they review your data practices." For most small business owners, $9 is the better deal. You also get cleaner data, a faster page (no heavy GA script), and a simpler reporting interface that you will actually open.
For a broader look at the infrastructure decisions that make up a solid site, the website foundation guide covers hosting, security, domain ownership, and the other systems that sit under your public-facing pages.