Cookieless tracking 2026: why we rely on Umami

That sounds paradoxical at first. Collect less data and still know more? The math works like this: cookie-based tools only measure visitors who accept the consent banner. In our projects, 30 to 60 percent of visitors decline, depending on the industry. Your statistics then show less than half of reality, and a distorted half at that: tech-savvy users decline more often.

Cookieless tools, by contrast, record every visit because they store no personal data. No cookies, no IP storage, no profiles. In return, the consent requirement for analytics no longer applies, and the numbers reflect all visitors again.

The price: you lose person-level features such as user-specific journeys across weeks or remarketing lists. Whether you ever used them is the honest counter-question.

We deliberately left out the enterprise class (Adobe Analytics, Piano Analytics). If you need attribution across ten channels and AI-supported forecasts, and have the budget to match, that is still the right place. For most mid-sized corporate websites it is overkill.

Our own website has run on self-hosted Umami since the relaunch. Three reasons tipped the scales:

First, the banner question. Without tracking consent, our website needs no analytics banner. That improves the user experience and the data quality at the same time.

Second, data sovereignty. Umami runs on our own server in Germany. There is no third party processing our visitor data for its own purposes.

Third, focus. Umami answers the questions that actually appear in management reports: how many visitors, from which sources, which content works, how many contact requests. Events and funnels also cover conversion paths. Whatever is missing, we have not missed it in two years.

An observation from client projects: the most common objection to switching is not functional, it is habit. GA4 dashboards feel familiar, even though hardly anyone uses more than four reports.

The screenshot shows what you see after logging in. Four metrics sit at the top of the dashboard: visitors, page views, bounce rate and visit duration, each compared to the previous period. Below them you find the trend over time and the most visited pages.

In practice, this single view is enough for a monthly report. It answers the standard management questions in a minute: are visitor numbers trending upwards? Which content draws people in? Do visitors stay or do they bounce?

What you do not see here: sampling notices, thresholds or modelled estimates for visitors without consent. The numbers are complete because no banner stands in the way. In client meetings, this is usually the moment when the discussion about data quality ends.

The second view that actually appears in reports is the sources list. It lists every referrer individually: Google, Bing, LinkedIn, linking industry portals. For a good two years now, AI systems have appeared there as well. In our own instance and in client projects, we now regularly see chatgpt.com among the most important sources.

For decision-makers, this list answers a budget question: which channels actually bring visitors, and how do they compare to each other? If LinkedIn activity eats a lot of working hours but delivers hardly any visits, it shows up here in black and white.

You track campaigns via UTM parameters, which Umami evaluates automatically. A newsletter link with utm_source and utm_campaign appears cleanly separated from organic traffic. How you build a dedicated segment from the AI referrers and interpret the numbers is what our post on AI referrals describes step by step.

Honesty belongs in every tool comparison, so here is the loss side. First, campaign attribution: Umami assigns a conversion to the source of that particular visit. If you steer budgets across several paid channels and want to know which first contact triggered an inquiry three weeks later, you will not get that answer here.

Second, demographic data. Age, gender and interest categories disappear. That hurts less than it sounds: in GA4, those values came from Google's advertising profiles and were modelled rather than measured. In our experience, they were rarely what guided B2B decisions.

Third, user-level long-term journeys and remarketing lists. Without profiles, there is no recognition across months and no export to advertising platforms.

Our rule of thumb from projects: if you put a large share of your marketing budget into paid channels and genuinely use multi-channel attribution, do the math carefully before switching. For the typical mid-sized corporate website, the loss list is bearable.

Visitor numbers alone do not justify a marketing budget. The real question is what visitors do. For that, Umami offers events and funnels, both without cookies.

An event is a countable action. Three examples we set up on B2B websites as standard:

1. Contact form submitted. The strongest signal; in Umami, a data attribute on the submit button is all it takes. 2. Whitepaper or guide downloaded. An early indicator: anyone pulling a PDF is researching seriously. 3. Phone number clicked. On mobile devices, often the most frequent conversion, and still invisible in many statistics.

Funnels chain such steps together. A typical funnel: service page, reference project, contact form opened, form submitted. Umami shows how many visitors drop off at each stage. If 80 percent are lost between opening and submitting, the problem lies in the form and not in the traffic.

A practical tip on discipline: create at most five to eight events and name them according to a fixed scheme, for example contact-form-submitted instead of Event17. In projects we regularly see GA4 setups with dozens of events that nobody can explain anymore. The tool switch is the best opportunity for this spring cleaning.

A common misconception goes: no cookies, no obligations. It is not that simple. One important note up front: we are not legal advisors, and the following points do not replace a legal review.

The privacy policy remains mandatory. Even anonymised web analytics is a processing operation that you must describe transparently: the tool used, the purpose, the storage location.

The consent banner question turns on Section 25 of the German TDDDG (the law governing access to information on end devices, formerly known as the TTDSG): consent is required from anyone who stores or reads information on the user's device. In our reading, which matches common vendor practice, a tool that sets no cookies and reads no device information does not fall under this obligation. We are not aware of a supreme court decision on this specific point. If in doubt, have your concrete setup reviewed.

Self-hosted, data sovereignty stays entirely in-house. With the cloud variant, a data processing agreement (AVV) is added; more on that in the FAQ at the end.

1. Run both in parallel (1 to 2 months). Add the new tool alongside the old one and compare the numbers. Expect noticeably higher visitor counts in the cookieless tool; that is the consent loss that was invisible before. 2. Define KPIs and events. Set up conversion goals (forms, calls, downloads) as events. This is the opportunity to drop legacy metrics nobody reads. 3. Switch off the old tool and update your privacy policy. Only then adjust or remove the consent banner.

Effort in our projects: a few person-days, depending on the number of events. If you want to know whether the switch pays off for your website, we will look at your current setup as part of the Future Check.