Analytics
Is Umami GDPR compliant?
Umami may run before the visitor has agreed, because it does not store or read anything on the device that goes beyond what is strictly necessary. It still belongs in your privacy policy.
- Category
- Analytics
- Needs consent
- No
- Leaves the EEA
- No
- Can be self-hosted
- Yes
- Recognised by
- umami.is
What does Umami do?
Open-source, cookieless analytics that most people run on their own server. Nothing is stored on the device and no cross-site identifier exists, so it is the usual answer to wanting numbers without a banner.
Does Umami need consent?
No consent is needed for Umami on its own, because it does not store or read anything on the device beyond what is strictly necessary. That is not a free pass: it must still be named in your privacy policy, and the request itself still reveals the visitor's IP address to the provider.
Does Umami send data outside the EEA?
No. Umami keeps processing inside the EEA, which removes the third-country question entirely. You still have to name it as a recipient in your privacy policy.
What can I use instead of Umami?
| Needs consent | Leaves the EEA | Can be self-hosted | |
|---|---|---|---|
| Umami | No | No | Yes |
| Plausible Analytics | No | No | Yes |
| Simple Analytics | No | No | No |
How do we detect Umami?
We load your page in a real browser as a first-time visitor who clicks nothing, then look at what it contacted. Umami is recognised by requests to umami.is, and we report whether it merely loaded or actually sent data, and whether it set a cookie before any choice was made.
Check your websiteThis describes the service as it is normally deployed. Your own configuration decides what actually happens, which is what a scan of your site shows. Not legal advice.