Short answer
You can get useful, privacy-friendly analytics without storing third‑party cookies by using either a cookieless analytics service (Plausible, Simple Analytics, Fathom, GoatCounter, etc.), a self‑hosted privacy tool (Matomo server‑side, PostHog configured no cookies), or server‑log analytics. For a small business I usually recommend a lightweight service (Plausible or Simple Analytics) or server‑log + a simple dashboard for the lowest maintenance and best privacy/compliance.
Why go cookieless
- Avoid cookie banners and consent friction (marketing cookies usually require opt‑in in many regions).
- Better privacy for users — fewer legal obligations and simpler compliance.
- Simpler, often faster scripts with less impact on page speed.
What you can still measure (typical small‑business focus)
- Pageviews, unique visitors (approximate), top pages.
- Referrers and campaigns (UTM).
- Device type, OS, browser family (no detailed fingerprinting).
- Landing pages, exit pages, simple funnels (e.g., homepage → product page → contact).
- Goal conversions: form submits, phone clicks, newsletter signups, purchases.
- Geo by country/region (approximate via IP).
Options and tradeoffs
- Cookieless hosted analytics (easy, low-maintenance)
- Plausible: privacy-first, no cookies by default, simple dashboard, lightweight script, affordable for small sites. Good for top-level metrics and UTM campaign tracking.
- Simple Analytics: similar to Plausible, focuses on privacy and ease of use, includes simple referrer details.
- Fathom: also privacy-focused; may use a small first‑party ID cookie optionally for unique visitor counts but can be configured to minimize cookies.
Pros: quick to install, GDPR‑friendly, fast, low learning curve.
Cons: fewer deep/custom reports; subscription cost.
- Self‑hosted privacy analytics
- Matomo (server-side or cookieless mode): very powerful, full control over data, can be configured to use no cookies or to anonymize IPs; requires hosting and maintenance.
- PostHog self‑hosted: more event/product analytics oriented; can be configured to respect privacy.
- GoatCounter (self‑hosted): lightweight and simple.
Pros: full control, flexible.
Cons: hosting/maintenance, more setup time.
- Server logs / log analytics (most privacy friendly, no client cookies)
- Use existing web server logs (Apache/Nginx) parsed by tools like GoAccess, AWStats, or import logs into a lightweight BI/dashboard.
Pros: no client script required, easy for static sites, low ongoing costs.
Cons: harder to attribute sessions/unique visitors, less rich client-side event tracking (need form submission endpoints to log).
- Hybrid / Consent Mode approaches
- Google Analytics 4: can be configured to limit cookies and use consent mode or cookieless measurement features, but GA still has privacy and data‑sharing considerations.
- Server-side tagging (e.g., Google Tag Manager server container): moves measurement to your server — can be used to reduce cookies and control PII, but is more complex.
What to avoid
- Fingerprinting techniques to identify users — privacy invasive and often illegal under GDPR/CU rules.
- Relying on third‑party cookies — blocked by browsers and problematic legally.
Practical recommendation for a small business (low effort, good value)
- If you want zero maintenance and fast setup: use Plausible or Simple Analytics.
- Install: paste a 1‑line script into <head>.
- Tracks pageviews, referrers, UTM, goals, and basic bounce/visit duration.
- Costs: low monthly fee for small sites.
- If you want free and very private:
- Use server logs + GoAccess for near‑real‑time reporting, or GoatCounter self‑hosted if you want a web UI.
- Add simple form endpoint logging for conversions.
- If you want full control but can host:
- Self‑host Matomo configured to disable cookies and anonymize IPs.
- Or set up a server-side collector (simple endpoint) to record events into a small DB and visualize with Metabase or Grafana.
Example minimal setup (Plausible)
- Sign up for Plausible, add site, copy script:
<script async defer data-domain="yourdomain.com" src="https://plausible.io/js/plausible.js"></script>
- Add goals for contact form and newsletter via events.
- Use UTM tags in campaigns for attribution.
Example minimal setup (server logs + GoAccess)
- Enable access logs on your web server (they usually are).
- Install GoAccess on the server and run:
goaccess /var/log/nginx/access.log -o /srv/www/analytics/report.html --log-format=COMBINED
- Automate daily generation and serve the HTML behind a password if you want.
Key metrics to track (start simple)
- Weekly visitors and sessions
- Top 10 pages
- Top referrers (including search vs socials)
- Conversions: contact form submissions, phone clicks, newsletter signups, sales
- Bounce rate / engagement time for top landing pages
- UTM campaign performance
Compliance notes
- Cookieless analytics greatly reduces the need for explicit cookie consent in many jurisdictions, but you still must:
- Avoid storing personal data (PII) in analytics.
- Anonymize IPs where required.
- Maintain a privacy policy that describes tracking.
- Honor do‑not‑track and local user rights where applicable.
If you tell me:
- your site platform (WordPress, Shopify, static site, custom),
- whether you want hosted or self‑hosted,
- examples of the metrics you care about (visitors, sales, contacts),
I can recommend the exact tool and give the precise install steps or a short script to add.