--- title: "Cookieless tracking 2026: why we rely on Umami" lang: en type: blog canonical: https://www.arocom.de/en/blog/cookieless-tracking-umami alternate: https://www.arocom.de/blog/cookieless-tracking-umami author: "Laura Murgia" published: 2026-06-10 last_updated: 2026-10-07 --- # Cookieless tracking 2026: why we rely on Umami Classic cookie tracking has been losing data quality massively since the end of third-party cookies and the rise of consent requirements. Cookieless tools such as Umami store nothing in the browser, run without a consent banner in common practice, and deliver the KPIs decision-makers actually use: visitors, sources, conversions, campaigns. arocom has moved its own analytics to self-hosted Umami. This post shows on the real dashboard what decision-makers get to see, names the losses of switching honestly, explains events and funnels for conversion measurement and puts the privacy side into perspective. Enterprise requirements such as attribution across multiple channels remain the domain of Adobe, Piano and GA4. ## Cookieless tracking 2026: why we rely on Umami This post has a backstory. In 2020, we compared the web tracking tools of the day in the old arocom blog, from Adobe Analytics to Google Analytics. The article was read steadily for six years. Since then, its core assumption has flipped: that tracking naturally sets cookies and a consent banner is part of the deal. Today the opposite is true. The best data goes to those who skip cookies and long-lived user profiles. This comparison shows why that is and which tool fits which company. ## Why cookieless tracking delivers better data That sounds paradoxical at first. Collect less data and still know more? The math works like this: cookie-based tools only measure visitors who accept the consent banner. In our projects, 30 to 60 percent of visitors decline, depending on the industry. Your statistics then show less than half of reality, and a distorted half at that: tech-savvy users decline more often. Cookieless tools, by contrast, record every visit because they store nothing in the browser. No cookies, no IP storage, no profiles across months. Umami recognises visitors only by an identifier it builds from the IP address and the browser identifier and recalculates at the latest when the month changes. That is pseudonymous, not anonymous: GDPR still applies, and the privacy policy has to say so. Even so, in common practice the analytics needs no consent banner, and the numbers reflect all visitors again. The price: you lose features such as user-specific journeys across months or remarketing lists. Whether you ever used them is the honest counter-question. ## The tools compared: GA4, Matomo, etracker, Umami | | GA4 | Matomo | etracker | Umami | | --- | --- | --- | --- | --- | | Cookieless possible | limited | yes (configurable) | yes | yes (always) | | Consent banner required | yes | depends on setup | no (default setup) | no (common practice) | | Hosting | Google Cloud (US) | self-hosted or cloud (EU) | Germany | self-hosted or cloud | | Costs | free (your data is the price) | from €0 (self-hosted) | from approx. €19/month | from €0 (self-hosted) | | Target group | marketing teams in the Google ecosystem | data sovereignty + feature depth | shops, GDPR focus | clear KPIs without ballast | | Complexity | high | medium | medium | low | We deliberately left out the enterprise class (Adobe Analytics, Piano Analytics). If you need attribution across ten channels and AI-supported forecasts, and have the budget to match, that is still the right place. For most mid-sized corporate websites it is overkill. ## Why we chose Umami Our own website has run on self-hosted Umami since the relaunch. Three reasons tipped the scales: **First, the banner question.** Without tracking consent, our website needs no analytics banner. That improves the user experience and the data quality at the same time. **Second, data sovereignty.** Umami runs on our own server in Germany. There is no third party processing our visitor data for its own purposes. **Third, focus.** Umami answers the questions that actually appear in management reports: how many visitors, from which sources, which content works, how many contact requests. Events and funnels also cover conversion paths. Whatever is missing, we have not missed it in two years. An observation from client projects: the most common objection to switching is not functional, it is habit. GA4 dashboards feel familiar, even though hardly anyone uses more than four reports. ![Umami dashboard with visitors, page views, bounce rate and visit duration](https://www.arocom.de/images/blog/umami-dashboard.webp) *The Umami dashboard of the official demo: the KPIs that actually appear in reports. (Source: public Umami demo, umami.is)* The screenshot shows what you see after logging in. Four metrics sit at the top of the dashboard: visitors, page views, bounce rate and visit duration, each compared to the previous period. Below them you find the trend over time and the most visited pages. In practice, this single view is enough for a monthly report. It answers the standard management questions in a minute: are visitor numbers trending upwards? Which content draws people in? Do visitors stay or do they bounce? What you do not see here: sampling notices, thresholds or modelled estimates for visitors without consent. The numbers are complete because no banner stands in the way. In client meetings, this is usually the moment when the discussion about data quality ends. ## The sources view: where your visitors come from The second view that actually appears in reports is the sources list. It lists every referrer individually: Google, Bing, LinkedIn, linking industry portals. For a good two years now, AI systems have appeared there as well. In our own instance and in client projects, we now regularly see chatgpt.com among the most important sources. ![Umami Sources view with referrers, including google.com and chatgpt.com](https://www.arocom.de/images/blog/umami-referrer-quellen.webp) *The Sources view lists referrers individually, AI systems such as chatgpt.com show up here too. (Source: public Umami demo)* For decision-makers, this list answers a budget question: which channels actually bring visitors, and how do they compare to each other? If LinkedIn activity eats a lot of working hours but delivers hardly any visits, it shows up here in black and white. You track campaigns via UTM parameters, which Umami evaluates automatically. A newsletter link with utm_source and utm_campaign appears cleanly separated from organic traffic. How you build a dedicated segment from the AI referrers and interpret the numbers is what our post on [AI referrals](https://www.arocom.de/en/blog/measuring-ai-referrals) describes step by step. ## What you lose by switching Honesty belongs in every tool comparison, so here is the loss side. First, campaign attribution: Umami assigns a conversion to the source of that particular visit. If you steer budgets across several paid channels and want to know which first contact triggered an inquiry three weeks later, you will not get that answer here. Second, demographic data. Age, gender and interest categories disappear. That hurts less than it sounds: in GA4, those values came from Google's advertising profiles and were modelled rather than measured. In our experience, they were rarely what guided B2B decisions. Third, user-level long-term journeys and remarketing lists. Because the visitor identifier changes at the latest when the month changes, there is no recognition across months and no export to advertising platforms. Our rule of thumb from projects: if you put a large share of your marketing budget into paid channels and genuinely use multi-channel attribution, do the math carefully before switching. For the typical mid-sized corporate website, the loss list is bearable. ## Events and funnels: measuring conversions without cookies Visitor numbers alone do not justify a marketing budget. The real question is what visitors do. For that, Umami offers events and funnels, both without cookies. An event is a countable action. Three examples we set up on B2B websites as standard: 1. **Contact form submitted.** The strongest signal; in Umami, a data attribute on the submit button is all it takes. 2. **Whitepaper or guide downloaded.** An early indicator: anyone pulling a PDF is researching seriously. 3. **Phone number clicked.** On mobile devices, often the most frequent conversion, and still invisible in many statistics. Funnels chain such steps together. A typical funnel: service page, reference project, contact form opened, form submitted. Umami shows how many visitors drop off at each stage. If 80 percent are lost between opening and submitting, the problem lies in the form and not in the traffic. A practical tip on discipline: create at most five to eight events and name them according to a fixed scheme, for example contact-form-submitted instead of Event17. In projects we regularly see GA4 setups with dozens of events that nobody can explain anymore. The tool switch is the best opportunity for this spring cleaning. ## Privacy assessment: cookieless does not mean rule-free A common misconception goes: no cookies, no obligations. It is not that simple. One important note up front: we are not legal advisors, and the following points do not replace a legal review. The privacy policy remains mandatory. Cookieless web analytics still processes personal data: the visitor identifier built from IP address and browser identifier is pseudonymous, not anonymous. The privacy policy therefore has to name the tool, the purpose, the legal basis (usually legitimate interest under Article 6(1)(f) GDPR), the identifier and how long it lasts, the events recorded, the storage location and how visitors can object. Umami honours the browser's "Do Not Track" setting if you switch that on in the script. That is the simplest way to object. The consent banner question turns on Section 25 of the German TDDDG (the law governing access to information on end devices, formerly known as the TTDSG): consent is required from anyone who stores or reads information on the user's device. Umami stores nothing. It does read something, though: the script queries screen resolution and browser language and sends both along. The German data protection authorities (DSK), in their guidance on digital services, treat it as access when a script reads properties of the device and transmits them to a server. The industry association Bitkom counters that such values are needed anyway to display the page. We are not aware of a supreme court decision on this specific point. We run Umami without a banner, as is common practice, and accept this residual risk. If in doubt, have your concrete setup reviewed. Self-hosted, data sovereignty stays entirely in-house. With the cloud variant, a data processing agreement (AVV) is added; more on that in the FAQ at the end. ### Is Umami really allowed without a consent banner? For pure analytics with Umami in its default configuration, our assessment is that you need no banner: Umami sets no cookies, stores nothing in the browser, and the analytics can rest on legitimate interest. That is the reading widely shared in the industry, but it is not legal advice. A grey area remains, because the script reads screen resolution and browser language, and the supervisory authorities treat such reading as access under Section 25 TDDDG. If you run additional services alongside it, such as advertising pixels or embedded videos, a banner may still be required for other reasons. ### What happens to the historical GA4 data? It remains in GA4 as long as the property exists, but it cannot be imported into Umami. Our recommendation: export the most important annual reports as spreadsheets before you retire the property, and accept a break in the time series. Because of the consent loss, the old numbers were not comparable with the new ones anyway. ### Do we need a data processing agreement? Not for self-hosting on your own infrastructure, because there is no external processor; you usually already have the contract with your server's hosting provider. With Umami Cloud or when an agency operates it for you, a data processing agreement (AVV) is part of the package. That is standard paperwork, not a project risk. ### Does Umami work with Drupal? Yes. Umami is embedded via a single script that fits any CMS; for Drupal there is also a ready-made module. You add events via data attributes directly in templates or components. A curiosity on the side: the official Drupal demo is also called Umami. The two have nothing to do with each other. ## Switching in practice: three steps 1. **Run both in parallel (1 to 2 months).** Add the new tool alongside the old one and compare the numbers. Expect noticeably higher visitor counts in the cookieless tool; that is the consent loss that was invisible before. 2. **Define KPIs and events.** Set up conversion goals (forms, calls, downloads) as events. This is the opportunity to drop legacy metrics nobody reads. 3. **Switch off the old tool and update your privacy policy.** It describes the visitor identifier, the events recorded and how to object. Only then adjust or remove the consent banner. Effort in our projects: a few person-days, depending on the number of events. If you want to know whether the switch pays off for your website, we will look at your current setup as part of the Future Check.