Skip to content
AI Act Checker

Analytics

Trackers we recognise

What each service does, whether it needs consent before it runs, and whether the data leaves the EEA.

Analytics

Measuring reach is a legitimate goal, but it is not necessary for the page to work, and regulators across the EU have been consistent that analytics identifiers need consent.

  • Google Analytics

    Google's traffic measurement, GA4.

    Needs consent · Leaves the EEA

  • Segment

    A customer data platform that collects events in the browser and forwards them to other tools.

    Needs consent · Leaves the EEA

  • Mixpanel

    Product analytics built on per-user event streams.

    Needs consent · Leaves the EEA

  • Amplitude

    Product analytics for funnels and retention, based on persistent user identifiers.

    Needs consent · Leaves the EEA

  • Matomo Cloud

    Analytics hosted in the EU, and self-hostable, which removes the third-country question.

    Needs consent · EEA

  • Plausible Analytics

    Cookieless analytics hosted in the EU and open source, so it can be self-hosted.

    No · EEA

  • Fathom Analytics

    Cookieless analytics with an EU isolation option that keeps processing inside the Union.

    No · EEA

  • Jetpack Stats

    WordPress statistics through Automattic.

    Needs consent · Leaves the EEA

  • Cloudflare Web Analytics

    Cookieless traffic measurement.

    No · Leaves the EEA

  • Piwik PRO

    Analytics with EU or private hosting and a consent manager built in.

    Needs consent · EEA

  • etracker

    German analytics hosted in Germany, which removes the third-country problem.

    Needs consent · EEA

  • HubSpot

    A marketing platform whose tracking script usually arrives with its chat or forms.

    Needs consent · Leaves the EEA

  • Umami

    Open-source, cookieless analytics that most people run on their own server.

    No · EEA

  • Simple Analytics

    Dutch analytics that deliberately collects no personal data and sets no cookies.

    No · EEA

  • Pirsch Analytics

    A German analytics service built around a cookieless fingerprint that is rotated daily.

    No · EEA

  • PostHog

    Product analytics with session replay and feature flags, open source and self-hostable.

    Needs consent · Leaves the EEA

  • Adobe Analytics

    Enterprise measurement, usually arriving through Adobe's tag manager.

    Needs consent · Leaves the EEA

  • Yandex Metrica

    Russian analytics that includes session recording by default.

    Needs consent · Leaves the EEA

  • Heap

    Product analytics that captures every interaction automatically rather than requiring events to be defined.

    Needs consent · Leaves the EEA

  • Marketo (Adobe)

    Adobe's marketing automation, loaded through its Munchkin script.

    Needs consent · Leaves the EEA

  • Common Room

    Go-to-market intelligence that stitches visits on your site to community, social and CRM profiles.

    Needs consent · Leaves the EEA

  • CaliberMind

    Revenue attribution that merges web sessions with CRM records to credit each marketing touch.

    Needs consent · Leaves the EEA

  • PPC Protect

    Click-fraud protection that fingerprints each visitor to judge whether an advertising click was genuine.

    Needs consent · Leaves the EEA

Advertising

Advertising is the clearest case in the whole regime. Building an audience or attributing a conversion serves the advertiser, never the visitor's request for the page.

  • Google Ads / DoubleClick

    Conversion tracking and remarketing for Google Ads.

    Needs consent · Leaves the EEA

  • Meta Pixel

    Facebook and Instagram conversion tracking.

    Needs consent · Leaves the EEA

  • TikTok Pixel

    TikTok's advertising pixel.

    Needs consent · Leaves the EEA

  • LinkedIn Insight Tag

    LinkedIn's conversion and audience tag, common on B2B sites.

    Needs consent · Leaves the EEA

  • X (Twitter) Ads

    Conversion tracking for X advertising, formerly Twitter.

    Needs consent · Leaves the EEA

  • Pinterest Tag

    Pinterest conversion tracking, common on retail and interiors sites.

    Needs consent · Leaves the EEA

  • Klaviyo

    Email and SMS marketing with on-site behaviour tracking.

    Needs consent · Leaves the EEA

  • Mailchimp

    Email marketing, usually present as an embedded signup form or a connected site script.

    Needs consent · Leaves the EEA

  • Microsoft Advertising (UET)

    The universal event tag behind Bing and Microsoft Audience ads.

    Needs consent · Leaves the EEA

  • Criteo

    Retargeting that follows shoppers across sites to show them products they viewed.

    Needs consent · Leaves the EEA

  • Taboola

    Content recommendation widgets, the sponsored links under an article.

    Needs consent · Leaves the EEA

  • Outbrain

    The other large recommendation network found beneath news articles.

    Needs consent · Leaves the EEA

  • Reddit Pixel

    Conversion tracking for Reddit advertising.

    Needs consent · Leaves the EEA

  • Snap Pixel

    Snapchat's advertising pixel, common on consumer and fashion sites.

    Needs consent · Leaves the EEA

  • Brevo

    Formerly Sendinblue, a French email and automation platform.

    Needs consent · EEA

  • CleverReach

    German newsletter software with hosting in Germany.

    Needs consent · EEA

  • ActiveCampaign

    Marketing automation with site tracking that follows a contact page by page.

    Needs consent · Leaves the EEA

  • OneSignal

    Web push notifications.

    Needs consent · Leaves the EEA

  • Bombora

    B2B intent data: it records which topics a visitor researches across a publisher network and sells that signal on to sales teams.

    Needs consent · Leaves the EEA

  • Demandbase

    Account identification that resolves a visitor's address to the company they work for, then personalises the page and alerts a salesperson.

    Needs consent · Leaves the EEA

  • LiveRamp

    An identity graph linking cookies, hashed email addresses and device identifiers so the same person can be recognised on unrelated sites.

    Needs consent · Leaves the EEA

  • PubMatic

    A programmatic exchange running real-time bidding against publisher inventory.

    Needs consent · Leaves the EEA

  • Magnite (Rubicon Project)

    Formerly Rubicon Project, a supply-side platform auctioning advertising space as the page loads.

    Needs consent · Leaves the EEA

  • Index Exchange (Casale Media)

    An advertising exchange still trading on its older Casale Media domain, which is why the host rarely matches the brand you recognise.

    Needs consent · Leaves the EEA

  • Quora Pixel

    Conversion measurement for advertising bought on Quora.

    Needs consent · Leaves the EEA

  • Influ2

    Person-based advertising that aims campaigns at named individuals inside target accounts and reports back who saw and clicked each ad.

    Needs consent · Leaves the EEA

  • Vector

    Visitor deanonymisation for sales teams, resolving anonymous traffic to companies and in some configurations to individual people.

    Needs consent · Leaves the EEA

  • Nexxen (Tremor)

    An advertising platform that traded as Tremor before the rename, strongest in video and connected-television inventory.

    Needs consent · Leaves the EEA

Session replay

Replaying a session captures far more than a page count, including what was typed into a form before it was submitted. That depth is why supervisory authorities treat it as high risk.

  • Hotjar

    Session recording and heatmaps.

    Needs consent · Leaves the EEA

  • Microsoft Clarity

    Free session recording and heatmaps from Microsoft.

    Needs consent · Leaves the EEA

  • FullStory

    Session replay for whole user journeys, including form interaction.

    Needs consent · Leaves the EEA

  • Mouseflow

    Recording and heatmaps from a Danish provider, so the data can stay in the EEA.

    Needs consent · EEA

  • Smartlook

    Czech session recording for web and mobile apps.

    Needs consent · EEA

Tag manager

The container itself stores nothing, so fetching it is not the issue. What it fires is, and a manager configured to fire on load makes every tag it carries unlawful.

  • Google Tag Manager

    A container that loads other tags.

    Needs consent · Leaves the EEA

  • Ensighten (Cheq)

    A tag management and client-side security layer, now part of Cheq.

    Needs consent · Leaves the EEA

Embedded media

An embedded player or map is content, not infrastructure. It can be loaded on a click instead, which is why loading it on arrival is a choice rather than a necessity.

  • YouTube embed

    A standard YouTube embed contacts Google and sets cookies as soon as the page loads, before anyone presses play.

    Needs consent · Leaves the EEA

  • YouTube (no-cookie embed)

    YouTube's privacy-enhanced embed.

    No · Leaves the EEA

  • Vimeo

    Video hosting whose player sets a tracking cookie by default.

    Needs consent · Leaves the EEA

  • Google Maps

    An embedded map contacts Google and can set cookies as the page loads.

    Needs consent · Leaves the EEA

  • Calendly

    Embedded appointment booking.

    Needs consent · Leaves the EEA

  • Trustpilot

    Review widgets from a Danish company, so the data stays in the EEA.

    Needs consent · EEA

  • Mapbox

    A mapping platform used as an alternative to Google Maps.

    Needs consent · Leaves the EEA

  • SoundCloud

    Embedded audio players.

    Needs consent · Leaves the EEA

  • Spotify embed

    An embedded player for tracks and podcasts.

    Needs consent · Leaves the EEA

  • Wistia

    Business video hosting with detailed viewing analytics.

    Needs consent · Leaves the EEA

Web fonts

A font is necessary; fetching it from someone else's server is not. The visitor's IP address reaches the provider on every page view, with no benefit that self-hosting would not also give.

  • Google Fonts (hosted)

    Web fonts loaded from Google's servers.

    Needs consent · Leaves the EEA

  • Font Awesome CDN

    Icon fonts from a CDN.

    Needs consent · Leaves the EEA

  • Bunny Fonts

    A drop-in replacement for Google Fonts served from the EU that logs no personal data.

    No · EEA

  • Adobe Fonts

    Typekit as it is now called, loaded from Adobe's servers.

    Needs consent · Leaves the EEA

Bot protection

Bot protection is a genuine need, but a service that profiles behaviour to score a visitor goes beyond what the site strictly requires, and there are alternatives that do not.

  • Google reCAPTCHA

    Google's bot protection.

    Needs consent · Leaves the EEA

  • hCaptcha

    A reCAPTCHA replacement that markets itself on privacy.

    Needs consent · Leaves the EEA

  • Cloudflare Turnstile

    Cloudflare's challenge, which usually verifies without asking the visitor to solve anything.

    No · Leaves the EEA

  • Friendly Captcha

    A German challenge that solves a cryptographic puzzle in the background instead of profiling the visitor.

    No · EEA

Content delivery

A library has to load; loading it from a third party does not. Serving the same file from your own domain removes the transfer and usually the latency argument with it.

  • Cloudflare CDN

    A public CDN for libraries.

    No · Leaves the EEA

  • jsDelivr

    A public package CDN serving npm and GitHub releases.

    No · Leaves the EEA

  • unpkg

    A CDN that serves any npm package directly.

    No · Leaves the EEA

Payments

Payment processing is necessary where payment happens. On pages where nothing is being bought, the same scripts lose that justification.

  • Stripe

    Payment processing.

    No · Leaves the EEA

  • PayPal

    Checkout and express buttons.

    No · Leaves the EEA

  • Klarna

    Buy-now-pay-later checkout from a Swedish provider, so processing stays in the EEA.

    No · EEA

  • Mollie

    A Dutch payment provider common in European shops.

    No · EEA

Error tracking

Knowing that your site broke is a real operational need, but it is your need, not a technical requirement of delivering the page to this visitor.

  • Sentry

    Error and performance monitoring.

    Needs consent · Leaves the EEA

Chat

A chat widget is only necessary once someone wants to chat. Loading it for every visitor turns an optional feature into unconditional processing.

  • Intercom

    Support chat and in-app messaging.

    Needs consent · Leaves the EEA

  • Drift

    Conversational marketing that qualifies leads through chat.

    Needs consent · Leaves the EEA

  • Crisp

    A French live chat with a generous free tier, common on small sites.

    Needs consent · EEA

  • Tidio

    Live chat with chatbots aimed at online shops.

    Needs consent · Leaves the EEA

  • Zendesk

    Helpdesk software whose chat widget is embedded on many support pages.

    Needs consent · Leaves the EEA

  • LiveChat

    A long-established chat product used on commercial sites.

    Needs consent · Leaves the EEA

  • Userlike

    German live chat hosted in Germany, which removes the third-country question that the American products raise.

    Needs consent · EEA

  • Freshchat

    Part of the Freshworks suite, offering chat and bots.

    Needs consent · Leaves the EEA

  • Botpress

    An open-source chatbot platform that can be self-hosted, which is unusual in this category and removes the transfer entirely.

    Needs consent · Leaves the EEA

  • Voiceflow

    A builder for conversational assistants whose runtime is embedded in the page.

    Needs consent · Leaves the EEA

  • Ada

    An automated support assistant that answers without a human.

    Needs consent · Leaves the EEA

  • Chatbase

    Turns a website's own content into a chatbot, popular with small businesses.

    Needs consent · Leaves the EEA

  • Google Dialogflow

    Google's conversational platform, often embedded through its df-messenger element.

    Needs consent · Leaves the EEA