Web Analytics Without Cookies: What Umami Can Do—and What It Can't

Why Many Companies Want to Measure More Efficiently

The questions a medium-sized company has about its website are straightforward: Which pages are being read? Where do visitors come from? Is the campaign generating inquiries? This doesn’t require a platform that tracks users across weeks and devices.

There are three reasons we hear time and again in conversations:

• Consent banners: The more data a tool collects about visitors, the longer the consent banners and privacy policy become.
• Data sharing: The analytics data is stored with a third party—often a U.S. corporation with its own interests in that data.
• Complexity: Anyone who only checks in every few weeks will find it hard to make sense of hundreds of reports.

Umami takes a different approach: few reports, no cookies, and—if desired—operated entirely in-house.

What Umami Measures—and How It Recognizes Visitors Without Cookies

Umami is open source under the MIT license. The overview fits on a single screen:

• Page views, visitors, and visits; bounce rate and session duration
• Traffic sources: referring websites, search engines, channels
• Countries, browsers, operating systems, and device types
• Entry and exit pages
• Custom events, such as “Form submitted” or “PDF downloaded”
• Campaigns via UTM parameters, including goals, funnels, and visitor paths

Starting with version 3.1, Umami can also track Core Web Vitals (LCP, INP, CLS, FCP, TTFB) from visitors’ browsers. This feature must be specifically enabled in the script.

The Changing Hash

To distinguish visitors from page views, the server generates a hash using the website ID, IP address, browser ID, and a changing random value (“salt”). This hash serves as the session ID. If the salt changes, a new ID is generated for the same visitor—there is no link to the old one.

One detail is often misrepresented: By default, the salt in Umami changes monthly, not daily. Since version 3.1, the frequency can be set to weekly or daily via the SALT_ROTATION setting. So if you choose Umami because of the daily rotation, you’ll need to enable it yourself.

What Umami deliberately does not do—and what it does not replace

Some features are intentionally missing:

• No recognition beyond the rotation period. A visitor who returns during the next period is counted as a new visitor.
• No tracking across multiple websites. The website identifier is embedded in the hash.
• No demographics, no interest profiles. Umami does not track age, gender, or purchase intent.
• No advertising integration. Target audiences for ad networks cannot be passed on.

Other tools handle these tasks better:

• Search terms: Only the search engines themselves—Google Search Console and Bing Webmaster Tools—show which search queries lead users to your pages. Both are free and require no script on the website.
• Tracking Across Weeks: If someone reads an article in March and makes an inquiry in May, Umami counts them as two separate visitors. For long decision-making processes in B2B business, checking your CRM or simply asking, “How did you find us?” remains more reliable.
• Heatmaps and session recordings: Something has changed here. Since version 3.1, Umami has included session recordings, and since version 3.2, click and scroll heatmaps—via an additional script. However, this is a different category than counting page views: it records the behavior of individual visits. We do not use these features and would not enable them without consent and our own review.

The legal side: “without cookies” does not mean “without consent”

This article is not legal advice. However, the basic structure can be described objectively. Two sets of regulations apply side by side.

Section 25 of the TDDDG protects the end device. Consent is required as soon as information is stored on or read from the device—except for what is strictly necessary to provide an expressly requested service. The law does not specifically mention cookies. Nor does it matter whether the information is personally identifiable. This also applies to the browser’s local storage, and the Data Protection Conference considers it an access when a script actively reads device properties to generate an identifier.

For Umami, this means: The script does not set any cookies. However, it uses JavaScript to read the screen size and browser language and checks the local storage to see if a visitor has disabled tracking for themselves. Whether this falls under Section 25 is a case-by-case determination that we cannot decide for you.

The GDPR also applies as soon as personal data is processed. The manufacturer states that Umami does not collect any personal data and anonymizes everything. However, the IP address is processed at least for hashing and country assignment. Whether a supervisory authority considers the session ID to be anonymous depends, among other things, on the rotation period.

The Guidance on Digital Services issued by the Data Protection Conference (Version 1.2, November 2024) is particularly insightful. It explicitly rejects the idea of categorizing audience measurement across the board as exempt from the requirement for consent. A statement to that effect would be possible, at most, for a precisely defined configuration and intended purpose; even the simple measurement of visitor numbers does not, per se, constitute part of the basic service. Anyone who reads that Umami “definitely does not need a banner” is reading a manufacturer’s statement, not the position of the German supervisory authority.

We have opted for a cautious approach: The Umami script is loaded on our website only after consent is given via the cookie banner. What this means for the numbers is explained below.

Self-hosted or Cloud—and a Comparison with Matomo and GA4

Umami comes in two forms. For self-hosting, you need a server running Node.js version 18.18 or higher and a PostgreSQL database version 12.14 or higher; the easiest way to run it is as a Docker container. The data remains on your own server, located here in Germany. In return, you’re responsible for updates, backups, and security. Umami is evolving rapidly—several feature releases came out in 2026 alone. An update takes just a few minutes, but someone needs to schedule it. Umami Cloud handles operations for you; according to the provider, the servers are located in the U.S. and the EU. In that case, you’ll need a data processing agreement and should clarify the data’s storage location.

None of the three tools is “the right one.” Matomo is a good fit if you want to perform more in-depth analysis and are already using PHP hosting. GA4 is a good fit if you manage Google Ads on a large scale. Umami is a good fit if your questions are straightforward and you want to keep the data in-house. We’ll support you with setup as part of a GDPR-compliant website and with hosting.

From our own experience: Interpreting the numbers correctly

Because our script only loads after consent is given, we only count visitors who have consented. Our numbers are therefore lower than the actual traffic. We make this trade-off intentionally. The important thing is to keep this in mind when interpreting the data:

• Trends rather than absolute values. You can tell whether an article is being read more this month than last month. You can’t tell how many people have read it in total.
• Don’t read too much into small numbers. With just a handful of views per day, a doubling is often just a coincidence.
• Compare similar time periods. Month to month, not a vacation week to a trade show week.
• Be cautious with “visitors” over long periods. Because of the changing hash, a regular reader is counted multiple times.

What three months of data have shown us: Most visitors from search engines don’t land on the homepage, but on a handful of practical how-to articles. The entry pages therefore reveal more than the sum of all page views. They show what someone is looking for—and whether the site guides them further or loses them.

Viewing Statistics in Plain Language

New to us: Since version 3.4, there’s been an official MCP server (@umami/mcp) that allows AI assistants to connect to Umami. We’ve connected our assistant to it using our own API key. This allows you to ask questions like “Which articles brought in visitors last month?” in plain language. According to the provider, all of the server’s tools are read-only. The assistant can retrieve statistics but cannot make any changes, and the key can be revoked at any time in the settings.

Conclusion

Umami answers the questions that most corporate websites actually have, with minimal effort and without cookies. It does not replace Search Console or the analysis required for lengthy decision-making processes, and it does not relieve you of the need for legal review. Those who understand this get a tool they can actually trust—and metrics whose limitations they’re aware of. If you’d like to set up a data-minimal web analytics solution for your website, please contact us.