Web analytics without Google: the privacy-friendly routes
Anyone wanting to change their web analytics rarely does so out of dissatisfaction with the numbers. It is usually about consent, data transfers, and the fact that a considerable share of visitors goes unmeasured anyway.
In short
- Three routes: analyse server logs, use a consent-free analytics service, or run a solution yourself.
- Server logs already exist, cost nothing extra, and are the only route that also shows AI crawler visits.
- What falls away in all three cases: recognition across several visits, and fine-grained attribution of paid advertising.
- "Cookie-free" does not automatically mean "consent-free" — what is regulated is access to the device as a whole.
The three routes
| Server logs | Consent-free service | Self-hosted | |
|---|---|---|---|
| Consent needed | no | depends on the setup | depends on the setup |
| Data stays with you | yes | no | yes |
| Additional cost | none | low to medium | server operation plus maintenance |
| Setup effort | low | low | high |
| Shows AI crawlers | yes | no | no |
| Shows referral sources | limited | yes | yes |
| Shows time on page | no | yes | yes |
| Captures all visitors | yes | usually yes | usually yes |
Worth knowing
Server logs are the only source showing whether your pages are being read by AI crawlers. An analytics tool in the browser sees none of it — crawlers do not execute JavaScript.
For anyone building visibility in answer engines that is not a side effect but a reason of its own: without log analysis you cannot establish whether GPTBot, PerplexityBot and the runtime fetches come by at all and which pages they take. That analysis costs nothing and is set up in an hour.
Server logs in detail
The server records which address was fetched when and by which identifier anyway. That data accrues independently of any analytics — it only has to be analysed.
What they show
Requests per page, the time, the requester's identifier, the referral source (as far as transmitted), the status code, error pages. And: every crawler visit.
What they do not show
Time on page, scroll depth, click paths within a page, recognition across several visits.
What to bear in mind
IP addresses are personal data. If logs are kept longer, they should be truncated or anonymised — and the retention period named in the privacy policy.
Effort
An hour to set up an analysis, then twenty minutes a month. No additional tool needed.
What falls away in all three cases
- Recognition across several visits. Without access to the device, a second visit by the same person is not recognisable as such.
- Fine-grained attribution of paid advertising. Anyone running ads at any scale loses the basis for allocating budget here — the largest practical loss.
- Ad audiences and retargeting. They require a tracking point and therefore need consent.
After a switch it nearly always stands out that the new numbers are considerably higher than the old ones — not because more visitors are coming but because a considerable share previously went unmeasured: everyone who declined the banner, plus everyone with an active ad blocker.
That regularly causes confusion in the first monthly report. So the report needs a sentence saying the time series is interrupted at this point — otherwise a change of measurement gets read as growth.
Which route for which situation
| If … | … then |
|---|---|
| little traffic, no ad budget | server logs alone |
| time on page and target actions needed | consent-free service plus logs |
| high privacy expectations in the audience | self-hosted plus logs |
| a meaningful ad budget | stay with the consent-based solution |
| visibility in AI answers is being built | logs in addition, in any case |
Help me decide how we should set up our web analytics. Our situation: - Visitors per month: [number] - Do we run paid advertising? [yes / no / scale] - Figures we base decisions on: [list] - Current solution: [details] - Do we have a consent banner? [yes / no] - Can we access server logs? [yes / no] - Are we building visibility in AI answers? [yes / no] Tasks: 1. From my list, check which of the figures we use would be available from server logs alone and which would not. 2. Recommend one of the three routes – logs, consent-free service, self-hosted – or a combination. Justify it. 3. Name concretely what we would lose under your recommendation, in terms of my list. 4. If we run paid advertising: say clearly what that means for the recommendation. 5. Name what has to be observed on data protection with server logs – particularly on IP addresses and retention. 6. Phrase a sentence for the first monthly report after the switch explaining why the numbers are not comparable. Do not recommend specific products.
In closing
The simplest route is closer than most people think: server logs are already there, cost nothing and answer the questions that count for small websites — which pages get read, where people come from, and whether AI crawlers are fetching us.
Anyone needing time on page and target actions adds a consent-free service. And anyone running advertising at any scale stays with the consent-based solution — there the loss is real.
Common questions
What alternatives to classic web analytics are there?
Three: analysing the server logs you already have, a consent-free analytics service, or a self-hosted solution. The first costs nothing extra, the second is quick to set up, the third keeps all data in-house but demands operation and maintenance.
What do server logs show that other tools do not?
AI crawler visits. Analytics tools in the browser see none of it, because crawlers do not execute JavaScript. Anyone building visibility in answer engines cannot establish without log analysis whether their pages are being fetched at all.
What do you lose with consent-free analytics?
Three things: recognition of the same person across several visits, fine-grained attribution of paid advertising to closes, and the building of ad audiences. The second point is the largest practical loss — anyone running ads at any scale loses the basis for allocating budget.
Is a cookie-free tool automatically consent-free?
No. What is regulated is access to the device as a whole — local browser storage and the evaluation of device characteristics for recognition fall under it too. What a tool actually does has to be checked and does not follow from the product description.
Why do the numbers rise after the switch?
Because a considerable share of visitors previously went unmeasured — everyone who declined the consent banner, plus everyone with an active ad blocker. That is not growth but a more complete measurement. The first monthly report therefore needs a note that the time series is interrupted.
Marketing that sets itself up
The Studio Engine beta is live. Claim your spot and help shape it from the start.
Join the beta →