“Cookieless analytics” has become a crowded shelf, and the marketing copy on most of these tools reads almost identically: no cookies, no fingerprinting, no personal data, no consent banner. It’s tempting to line them up side by side and pick the one with the nicest dashboard.
That comparison breaks down the moment you look at what each tool is actually for. Some of these products are built so they physically can’t collect personal data. Others are built to hand you all of it. Both can be the right answer - but they’re answering different questions, and the privacy claims mean very different things depending on which kind of tool you’re holding.
This post walks through three of them - Simple Analytics, Plausible, and our own d8a.tech - and explains how each one measures, where the privacy claims come from, and why you can’t map one tool’s promises one-to-one onto another.
A note on who’s writing: d8a.tech is one of the three tools compared here. We’ve tried to describe Simple Analytics and Plausible the way their own documentation does, and to be honest about where our product is a different kind of thing rather than a better version of the same thing.
The short version
These three tools fall into two fundamentally different categories, and that split is where the difference in claims comes from.
Simple Analytics and Plausible are privacy-minimalist tools. They’re designed to measure as little as possible - just enough for aggregate statistics - and deliberately built so that no personal data is ever created in the first place.
d8a.tech is a data-ownership tool. It’s designed to capture the full clickstream and route it into your own data warehouse. It’s essentially a self-hosted GA4 replacement.
So the claims “no cookies / no fingerprinting / no personal data” are core product promises for Simple Analytics and Plausible - properties locked into the design. For d8a.tech, those aren’t built-in guarantees. They’re things you configure and remain responsible for yourself.
That “configure” word does a lot of work, though, and it’s worth being precise about how much. In practice, nearly any of these properties - including a full cookieless mode - is a few clicks away in d8a.tech, and several of them apply by default if you already run a consent management platform on your site. The point isn’t that d8a.tech makes privacy hard. It’s that d8a.tech lets you choose, where the other two decide for you.
Keep that distinction in mind, because everything below follows from it.
How Simple Analytics measures
Simple Analytics works without storing anything in the visitor’s browser - no cookies, no localStorage. No IP addresses are stored to track visitors, nothing is written to the device, visitors aren’t tracked across multiple sessions, and there’s no cross-device tracking.
The crucial consequence: because there’s no persistent per-visitor identifier, Simple Analytics simply cannot recognise an individual over time or across pages. It measures at the aggregate level - pageviews, referrers, top pages, bounce rate - without ever building a per-person profile. User-level tracking across sessions isn’t a feature that’s switched off; it’s a capability the design never includes.
Here’s what each of the three claims means technically:
- No cookies - literally nothing is written to the browser that gets read back on a return visit. That’s why no consent banner is needed.
- No fingerprinting - they don’t try to reconstruct a stable “fingerprint” of a visitor from signals like IP + user-agent + screen resolution. This matters, because that’s exactly the technique some other “cookieless” tools do use (more on that below).
- No personal data - because IPs aren’t stored and there’s no per-person identifier, no datapoint traceable to an individual is ever created.
Under GDPR and ePrivacy, consent is typically required when personal data is processed or when tracking technologies like cookies are used. By not collecting personal data and not using cookies, Simple Analytics removes the trigger for consent in most cases. The company states this approach has been reviewed by multiple data protection authorities and confirmed not to require consent. In other words, the three claims aren’t just marketing - they’re the legal foundation the product stands on.
How Plausible measures
Plausible sits in the same category as Simple Analytics and works very similarly, but there’s one technical detail worth knowing, because it nuances the “no fingerprinting” question.
Plausible’s stated philosophy: no cookies, no persistent identifiers, and no collection or storage of personal data that can identify individuals - all data is aggregated. Like Simple Analytics, it doesn’t track people across devices or websites; data is isolated to a single day, a single website, and a single device.
The interesting part is how Plausible counts unique visitors without a cookie. To do it, the tool generates a random string of letters and numbers that resets every 24 hours, so there’s no way to connect a visitor’s activity across sessions, across days, or across devices.
Under the hood, that daily string is derived from a rotating salt combined with request data. Every HTTP request includes the IP address and user-agent, but Plausible doesn’t attempt to generate a device-persistent identifier and doesn’t use cookies, browser cache, or local storage. The IP and user-agent are hashed against an anonymised, rotating daily salt that can’t be reversed.
Plausible does momentarily process the IP and user-agent server-side to compute a daily, non-reversible hash. Because the salt rotates every 24 hours and nothing persistent is stored, the result isn't classified as personal data and isn't a persistent fingerprint. Both tools can credibly claim "no cookies / no fingerprinting / no personal data" - but the route differs: Simple Analytics avoids the IP entirely, while Plausible's claim rests on salt rotation and irreversibility.
Plausible also stores all visitor data exclusively on European-owned infrastructure that never leaves the EEA, and the product is open source and can be self-hosted.
How d8a.tech measures
d8a.tech is a completely different animal. It’s warehouse-native analytics, compatible with the tracking protocols of Google Analytics and Matomo, ingesting data into ClickHouse, BigQuery, or CSV/Parquet - while you retain complete control over your data.
The core idea: d8a.tech decouples data collection from visualisation, so engineers can build their own pipelines without the “Google Tax” that comes with proprietary platforms. There are two ways to run it. The cloud version ships with a visualisation layer and an AI agent interface, so you do get charts and answers out of the box. The open-source version is headless by design - it’s built for teams who want d8a.tech purely to gather data into their own data stack, remaining in full control of it, and who are happy to write the SQL and wire up their own visualisation tools.
And here’s the difference you’re looking for. Because d8a.tech speaks the GA4 protocol, it receives - by default - the identifiers built into that protocol. Most importantly the client_id. That’s a browser-scoped identifier stored in a cookie, and it’s anything but anonymous: it powers user counts, session stitching, and attribution.
More importantly: the European Data Protection Board has classified online identifiers - including cookie-based IDs like client_id - as personal data when combined with other datapoints (IP, behaviour, device) that can re-identify a person.
In other words: a standard d8a.tech setup does in principle process personal data, and does involve a cookie. That’s not a shortcoming of d8a.tech - it’s the design goal. You get the full clickstream. The data has to be rich enough to be worth owning. And crucially, cookies can be switched off entirely, putting d8a.tech in a cookieless mode much like Plausible’s - the difference is that this is a setting, not a hard limit of the product.
This is also where d8a.tech quietly fixes the things GA4 handles poorly. Sessions are scoped and stitched on the backend rather than reconstructed from fragile client-side signals, so they hold up where browser-side counting falls apart. And when consent isn’t given, d8a.tech can fall back to a true anonymous tracking mode - close in spirit to what Plausible does - measuring the session without ever creating a persistent identifier.
Where the difference actually sits
The difference isn’t “one is privacy-friendly and the other isn’t.” It’s about who is responsible for the privacy properties, and at what level measurement happens.
Simple Analytics and Plausible - privacy as a product guarantee. The tool can’t collect personal data, because the identifiers simply don’t exist (Simple Analytics) or are deliberately non-persistent and irreversible (Plausible). The three claims are properties baked into the design that you can’t switch off. The price you pay is that you only get aggregates - no individual visitor journeys, no cross-session or cross-device insight.
d8a.tech - privacy as a configuration and infrastructure matter that you manage. d8a.tech’s claim isn’t “no personal data” - it’s data sovereignty. You decide where the data lands and who can access it. In the on-premises model, d8a.tech has no access to your data and is neither processor nor controller under GDPR. In the cloud model, it acts as a stateless conduit that forwards your data to your own storage without persisting raw clickstream data. Either way, you are the Data Controller.
If the data contains personal data - and with a persistent identifier in play, that's the default - then it's your responsibility to obtain consent, set a retention period, and handle data-subject requests. Because d8a.tech doesn't store the data, those access and deletion requests must be fulfilled by you. That's the trade that comes with ownership.
Summary table
| Simple Analytics | Plausible | d8a.tech | |
|---|---|---|---|
| Goal | Minimal aggregate stats | Minimal aggregate stats | Full clickstream in your own warehouse |
| Measurement level | Aggregate (no individual recognisable) | Aggregate (no individual recognisable) | Event / session level per identifier |
| Cookies | None, by design | None, by design | client_id cookie by default; can be disabled |
| Per-visitor identifier | None | Rotating 24h hash (non-persistent) | client_id, or a session-only hash that isn’t persisted |
| Personal data | Not collected, by design | Not collected, by design | Potentially yes - you manage it |
| Consent needed | Usually not | Usually not | Depends on your configuration |
| Hosting | SaaS; EU-only data | SaaS or self-hosted; EU-only data | SaaS or self-hosted; EU-only data |
| Open source | No | Yes (AGPL) | Yes (MIT) |
The simplest way to remember it
Simple Analytics and Plausible promise that they can never collect certain data. d8a.tech promises that all the data is yours. Those are two different kinds of promise - which is exactly why you can’t map Simple Analytics’ three claims one-to-one onto d8a.tech. d8a.tech doesn’t make those claims, because it’s a different type of product.
There’s one more point worth ending on, though, because it’s the thing that tends to decide which side of the line a team should be on.
You can’t outgrow d8a.tech. Because it captures the full clickstream into a schema you own, its reach grows with you - there’s no ceiling where you suddenly need a “real” analytics stack bolted on beside it. That ceiling, on the other hand, arrives fast with Plausible and Simple Analytics: whenever you need a custom report, or a join against your own business data, the aggregate-only model has nothing more to give you, by design.
And the reverse isn’t symmetrical. The two things Plausible and Simple Analytics do beautifully - compliance and simplicity - are also achievable with d8a.tech. It’s a matter of a few switches in the UI: turn off the persistent identifier, run in anonymous mode, keep everything EU-only or on-premises. You can start strict and minimal and loosen later, or start rich and tighten - but only the data-ownership model lets you change your mind without changing tools.
So the honest summary is this. If you’d rather not think about any of this and you’re happy to pay for that peace of mind, Simple Analytics or Plausible are excellent at exactly that - aggregate stats with zero responsibility. But it’s worth knowing that d8a.tech gives you the same simplicity and compliance when you want it, on top of a generous free tier and far richer data - and the headroom to grow into the rest later, without ever switching tools.