Umami: Privacy-First Analytics Without the Cookie Banner

Google Analytics 4 is free in the same way Gmail is free - you get the tool, Google gets the behavioral data of everyone who visits your site. In several EU jurisdictions this transfer has already been ruled non-compliant. Umami is the simplest exit: a single tracking script, no cookies, no personal data, a dashboard that shows you everything you need. MIT licensed, Next.js, PostgreSQL, Docker. Self-hosted free on a $7/mo VPS or use Umami Cloud.

What Umami is

Umami (umami.is, github.com/umami-software/umami) is a privacy-first web analytics platform. Next.js frontend and API, PostgreSQL database. MIT licensed. No cookies by default. No personal data stored. GDPR, CCPA, and PECR compliant without a cookie consent banner. Self-hosted is free with unlimited pageviews.

What it tracks

Page views - every visit with URL, referrer, timestamp. Unique visitors - counted by a rotating daily hash of IP + user agent, no persistent identifier stored. Sessions, bounce rate, visit duration.

Traffic sources - referrers, UTM parameters (source, medium, campaign, term, content). Campaign tracking without cookies. Device breakdown - browser, OS, device type, screen size. Geography - country, region, city derived from IP; IP not stored.

Custom events - track any user action. Call umami.track('event-name', props) from JavaScript, or use data-umami-event HTML attributes with no JavaScript needed. Events appear in the dashboard with property breakdowns.

Funnels - multi-step conversion paths, see where users drop off. Goals - set a target pageview or event count and track progress. Reports - save and share custom configurations: journey, retention, UTM, insights report types. Real-time view - active visitors right now. Period comparison - any two date ranges side by side.

The tracking script

One script tag under 2KB. No cookies. No fingerprinting. No cross-site tracking. Open source and inspectable. HTML attribute events without JavaScript: data-umami-event="signup" data-umami-event-plan="pro" on any element.

Self-hosting

Docker Compose with Umami and PostgreSQL. docker compose up -d, visit http://localhost:3000, login admin/umami (change immediately), add your site, copy the script tag. Takes 10 minutes. Node.js 18.18+ and PostgreSQL 12.14+ for source installs. Updates: docker compose pull then recreate.

Multi-site, teams, API

One instance handles unlimited websites. Team workspaces with view or admin roles per member. Public shareable dashboard links for clients without account access. Full REST API for pageviews, sessions, events, active users. API key authentication.

Umami Cloud

Managed by Umami Software Inc. Hobby: free, 10k monthly events. Pro: from $20/month, 1M events, EU data residency option. Same codebase as self-hosted.

vs Google Analytics and Plausible

vs GA4: GA4 wins on attribution modeling, audience segments, Google Ads integration. Umami wins on data ownership, no cookie banner needed, readable dashboard, no sampling, MIT license.

vs Plausible: Both cookieless with clean dashboards. Plausible is AGPL-3.0, EU-hosted cloud from $9/mo for 10k pageviews, slightly more features. Umami is MIT (better for commercial embedding), truly unlimited self-hosted free. Pick Umami for MIT license or unlimited self-hosted; pick Plausible for a stronger opinionated EU cloud.

Who it is for

Good fit: developers replacing GA4 wanting cookieless tracking; EU sites with GDPR concerns; agencies giving clients read-only dashboards; self-hosters on their own PostgreSQL; projects where MIT license matters for commercial embedding.

Not ideal: teams needing GA4-level attribution and audience segments; sites needing heatmaps or session recordings (PostHog or Hotjar); very high traffic needing tuned Postgres performance.

My take

Umami solves the specific problem of knowing how many people visit your site and what they look at, without putting Google in the middle. The dashboard is fast and readable. The MIT license and PostgreSQL backend mean you can query the database directly if the built-in reports don't cover your use case. For most sites replacing GA4, it's the right call.