Self-hosted Google Analytics alternative for EU data residency

Why EU teams look for a self-hosted Google Analytics alternative for data residency

If your GA4 deployment is under review because of transfers, the consent banner or how much control you have over the data, the short answer is this: self-hosted Matomo, Plausible Community Edition or PostHog can keep analytics data on infrastructure your organization controls, but the transfer position depends on where that infrastructure runs and who operates it. Hosting on servers in the EU with your own staff or an EU provider removes the largest part of the transfer question, while a self-hosted tool on a US-controlled cloud account still raises it. Start by writing down where every analytics table, log and backup physically sits and which legal entity operates it.

The European Commission adopted the EU-US Data Privacy Framework adequacy decision on July 10, 2023 (decision 2023/1795). Under it, personal data can flow from the EU to US companies on the Data Privacy Framework List without further transfer safeguards. That changed the analysis for GA4, which is operated by a US company, but it did not settle the underlying concerns about US public authority access. The decision is under challenge: an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Ask your counsel to confirm the current status of that appeal and the vendor's listing on the framework before you rely on it for a transfer register.

Google states that Google Analytics collects data from EU, Swiss and UK devices on servers in those regions and drops IP addresses before logging, before forwarding data for processing. That is a statement about collection, not about the whole processing chain. Reports, administration, support access and any onward processing can still involve systems outside the EU, so the question for your data protection officer is which parts of GA4 you have verified, not whether Google has an EU collection point. Compare that with a self-hosted tool, where you can document each hop yourself.

What EU data residency requires from an analytics tool

For an EU organization, the analytics question is less about the vendor's marketing and more about where personal data goes, who can reach it, and whether the tracker needs consent at all. The four points below set the conditions a self-hosted tool must meet and the exposure that remains even when it is run in your own infrastructure.

Transfers need Chapter V conditions

GDPR Article 44 applies to every transfer of personal data to a third country, including onward transfers, and each transfer must meet the conditions in Chapter V. Infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover under Article 83(5)(c). For GA4, ask which entity processes each data flow and whether any flow leaves the EU. For a self-hosted tool, map where the database, backups and support access sit.

Remote access counts as transfer

EDPB Guidelines 05/2021 state that remote access from a third country is a transfer, even when the person only views data on a screen for support or administration. Storage in a cloud outside the EEA is also a transfer. Check who at your vendor or hosting provider can open the analytics database from outside the EEA, including during incident support. Restrict administrator access and log it, whether the tool is hosted by a vendor or by you.

CNIL exemption has strict limits

CNIL sheet 16 lists conditions for analytics trackers to run without consent: purposes limited to audience measurement and A/B testing, a single publisher scope, no cross-checking with other processing, truncation of the last byte of the IP address, and a tracker lifetime of at most 13 months. CNIL also says most large audience measurement offerings fall outside the exemption whatever their configuration. Confirm each condition in your own setup before you drop a consent banner.

Foreign authority access limits controls

The US CLOUD Act provision at 18 U.S.C. 2713 requires US providers to preserve or disclose data in their possession, custody or control, wherever it is located. GDPR Article 48 allows a third-country disclosure order to be enforced only under an international agreement in force with the Union or a Member State. EDPB Recommendations 01/2020 state that where a provider must access data in the clear and the foreign powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Ask your provider which jurisdiction controls the company and its keys.

What Google's EU data collection does and does not cover

Google's EU-focused documentation says that Google Analytics collects data from devices in the EU, Switzerland and the UK and processes it on servers in those regions. It also says that IP addresses are dropped before data is logged, and that this happens before data is forwarded for processing. For a compliance team, this is a statement about the collection point and the first logging step, and it is useful evidence for those specific points only.

Collection region: data from EU, Swiss and UK devices is collected on servers in those regions.
Storage at collection: the statement covers the first storage step on servers in those regions.
IP handling: IP addresses are dropped before logging, a control that is separate from the last-byte truncation CNIL requires for exempt analytics.
Sequence: IP removal happens before forwarding for processing, so the sentence does not describe what happens to events afterward.

Read the current wording in Google's EU data and privacy article and confirm that it matches the version your data processing agreement references.

What the EU-US Data Privacy Framework changed for transfers

The EU-US Data Privacy Framework removed one legal barrier for transfers to the United States, but only for organizations that appear on the Data Privacy Framework List. The Commission adopted its adequacy decision, Commission Implementing Decision (EU) 2023/1795, on July 10, 2023. It finds adequate protection only for US organizations that are on that list. A US analytics vendor that is not certified under the framework cannot rely on the decision, so the first check is to confirm the vendor's current listing, not the vendor's marketing claim. The decision is also under challenge. The General Court upheld it in September 2025, and an appeal is pending as Case C-703/25 P. Plan for the possibility that the decision could be annulled, and ask your counsel what fallback transfer tool you would use if it were.

The history explains why the fallback matters. On July 16, 2020, the Court of Justice of the EU, in Case C-311/18 (*Schrems II*), invalidated the Privacy Shield adequacy decision 2016/1250. The Court held that standard contractual clauses remained valid, but controllers using them must assess whether the destination country's law allows access that the clauses cannot overcome. The CJEU press release on Case C-311/18 summarizes that outcome. For a US-linked analytics vendor, the transfer assessment therefore still depends on the vendor's contracts and on the legal exposure of its corporate group.

The framework does not change CLOUD Act exposure for a US-parented processor. Under 18 U.S.C. 2713, providers subject to US jurisdiction must preserve or disclose data in their possession, custody or control, wherever that data is stored. Hosting analytics in Frankfurt or Paris does not remove that obligation for a US-parented provider. The EDPB's Recommendations 01/2020 also state that where destination-country powers go beyond what is necessary and proportionate, it cannot envision an effective technical supplementary measure. The practical decision is whether analytics data about EU visitors should sit under a US-parented processor at all. A self-hosted deployment in your own EU infrastructure, where your organization is the only party holding the data, removes that third-party exposure. Confirm with your legal team how your contracts and the vendor's group structure map to these points.

Which self-hosted options fit a residency constraint, and their trade-offs

This table compares Matomo On-Premise, Plausible Community Edition and PostHog on license, how each keeps analytics data inside your infrastructure, and the trade-offs that matter for EU residency. Read each row as a question to answer for your own environment: which features you need, who operates the server, and whether a consent banner is acceptable. Umami and Jitsu are covered on their sibling pages.

Option	License	How it meets residency	Trade-offs
Matomo On-Premise	GPLv3 core, free to self-host. Heatmap and Session Recording is a paid plugin under the InnoCraft EULA	Runs on your own servers, so visitor data stays where you host it. Can be configured to the CNIL audience measurement conditions, which may avoid a consent banner for analytics	Google Analytics Importer brings in aggregated reports only, so Visitor Log and segments do not work on imported history. Heatmaps and recordings are paid and remove the consent exemption. You operate upgrades, backups and capacity
Plausible Community Edition	AGPLv3, free to self-host	Cookieless design and self-hosting keep traffic data on your infrastructure. Confirm with your DPO whether the no-cookie design satisfies your consent position in each country	Funnels, user journeys, ecommerce revenue goals and SSO are Cloud-only. Long-term releases ship twice a year, and security fixes arrive only when you apply them. Requires Docker and at least 2 GB RAM
PostHog self-hosted	MIT, except the ee directory, which needs a paid license for premium features. The posthog-foss repository contains no proprietary code	Self-hosted instances keep event data on your servers. PostHog Cloud EU is hosted in the EU but is not self-hosted, so confirm its processor terms and transfer position separately	Premium features need the ee license, so confirm which features you need before choosing the foss build. Broader scope means heavier infrastructure and operations than a pageview tool

How a self-hosted Matomo configured to CNIL's conditions avoids a consent banner

A self-hosted Matomo instance can run analytics without a consent banner only if every setting stays inside the conditions CNIL lists in sheet 16. The exemption is conditional, and the configuration is the part you own. Start by writing down the purposes: the tracker may measure audience and run A/B tests, and nothing else. Matomo's own ePrivacy FAQ says CNIL treats some audience measurement trackers as exempt when they collect only anonymous statistics and exclude marketing measurement, and that adding User ID, heatmaps or session recordings removes the exemption. That means the Heatmap and Session Recording plugin, which is a paid premium plugin, and any User ID tracking must stay off for the exempt tracker. Keep the single publisher scope too: the data should cover your own site only, with no cross-checking against CRM, advertising or other processing.

The technical settings are the ones to verify on the live site rather than assume. Truncation of the last byte of the IP address must be enabled in Matomo's privacy settings, and the tracker lifetime, meaning the retention of the visitor cookie and visit data, must be set to at most 13 months. Confirm both by inspecting the tracking request and the cookies a browser actually receives, and keep a dated record of the settings for your file. Document the purposes, the configuration and the test results in a short record your DPO can review. Ask your DPO or counsel to confirm that your specific data flows meet the criteria, because the exemption depends on the whole processing chain and not on the software alone.

Set expectations on the outcome. CNIL's analytics guidance states that most large audience measurement offerings do not fall within the exemption regardless of configuration, so a sophisticated setup does not guarantee it for every product. Matomo's FAQ also names Italy, the Netherlands and Spain as authorities that exempt certain privacy-focused analytics when criteria are met, and suggests following the CNIL configuration there. Check the current guidance of each authority that applies to your audience, because a configuration accepted in France does not automatically carry over to other member states. If your organization needs a feature that breaks the exemption, plan for a consent flow on that tracker instead of disabling the feature silently.

How to deploy self-hosted analytics inside EU infrastructure

This sequence takes an EU organization from choosing a hosting location to a documented, reviewed Matomo or Plausible deployment that keeps analytics data under its own control and sets up the conditions for consent-exempt measurement.

Choose an EU hosting location and operator model
Your infrastructure team selects a data center or cloud region inside the EU or EEA and decides who operates the servers. Confirm in writing that no operator, support engineer or vendor will access the data from a third country, including remote screen sharing for support, because EDPB Guidelines 05/2021 treat that access as a transfer. Also check whether any hosting provider is subject to third-country law with extraterritorial reach, such as the US CLOUD Act at 18 U.S.C. 2713, and record your assessment. The output is a signed hosting decision and an operator access map that names every person and system with access.
Size the server for expected pageviews
Estimate your monthly pageviews from current GA4 reports, then size the hosting. Matomo's requirements FAQ describes a single server with at least 4 CPUs, 8 GB of RAM and 250 GB of SSD for up to 1 million pageviews a month, and recommends separate app and database servers with 8 CPUs and 16 GB of RAM each for up to 10 million pageviews a month. Ask your hosting provider to quote these specifications in the EU region you chose. The output is a written sizing sheet tied to your pageview forecast.
Install with supported PHP and database versions
Your platform team installs Matomo behind a supported web server such as Apache or Nginx. For Matomo 6.0.0, the requirements FAQ calls for PHP 8.1 or newer and MySQL 8.0 or newer or MariaDB 10.6 or newer. Matomo 4.16 and 5.x run on PHP 8 with MySQL 5.5 or later or MariaDB. Check the Matomo changelog for the current stable release before choosing a version, and keep the database on the same EU infrastructure. The output is a working installation that loads the admin dashboard over HTTPS with the database in the EU.
Configure tracking to the CNIL conditions
Your analytics or web team configures the tracker to match CNIL sheet 16: truncate the last byte of the IP address, set the tracker cookie lifetime to 13 months or less, and limit use to audience measurement and A/B testing. Disable User ID, heatmaps, session recordings and any cross-checking with other data, because Matomo's ePrivacy FAQ says these features remove the exemption. Confirm the site scope covers one publisher only. The output is a tracker configuration export and a screenshot record of each setting, kept with your change log.
Set retention, IP and data handling rules
Your data owner sets how long raw visit data is kept and who can see it, then documents those rules. Align the raw data retention period and the tracker lifetime with your privacy notice and the CNIL conditions. If you import GA4 history with the Google Analytics Importer, note that it brings aggregated reports only, so raw-level views such as the Visitor Log will not cover imported periods. The output is a retention schedule and access list approved by the data owner.
Document the DPA, transfer assessment and processing records
Your privacy and legal team completes the processor documentation for the chosen hosting and any support vendor, including a data processing agreement that confirms EU storage and access limits. Record the analytics activity in your records of processing under GDPR, and document why no transfer occurs or which Chapter V mechanism applies if a non-EU party can access data. Do not rely on the EU-US Data Privacy Framework adequacy decision for a vendor unless it is on the Data Privacy Framework List and you have confirmed the current status of the pending appeal. The output is a signed DPA and a completed records entry.
Set up backups, updates and security releases
Your operations team sets up scheduled database and file backups stored in the EU, tests a restore, and assigns an owner for applying Matomo releases. If you choose Plausible Community Edition instead, note that it is community supported, gets security fixes only when you apply the release, and ships on a long-term twice-yearly cadence, so you must monitor the plausible/analytics releases page and apply security versions such as v3.2.1 promptly. The output is a backup restore test record and a written patch calendar with a named owner.
Commission an independent review before relying on the exemption
Before you drop the consent banner for analytics, ask an independent privacy or security reviewer to check the live configuration against CNIL sheet 16 and your records. The reviewer assesses the tracker, retention, IP handling and access list, and tests whether any enabled feature removes the exemption. Confirm with your national supervisory authority or legal counsel whether your country follows the CNIL approach. The output is a written review report with findings closed before the banner is removed.

Evidence an auditor or regulator will ask for

A regulator or auditor will not accept a tool choice on its own. They will ask for documents and configuration records that show how analytics data is collected, where it is stored, who can reach it and how the platform is kept current. DeployOpen prepares this evidence with your team, but independent auditors and data protection authorities decide whether your setup is adequate.

Records of processing

Your record of processing activities should list analytics as its own entry, with the purpose (audience measurement, A/B testing), the data categories collected, the recipients and the retention period. Check that the purpose wording matches the CNIL exemption conditions if you rely on them. Confirm that no other processing, such as advertising or cross-checking with a CRM, is recorded against the same data.

Tracker configuration evidence

Keep a dated export or screenshot of the tracker settings that show the exemption conditions: a single site scope, audience measurement and A/B testing only, and no User ID, heatmaps or session recordings enabled. Store the configuration in version control so any later change leaves a trail. Heatmap or recording plugins, even when disabled, should be documented as out of scope.

IP truncation and retention settings

Show the anonymization setting that truncates the last byte of the IP address before storage, and the tracker lifetime, which must not exceed 13 months under CNIL's conditions. Pair the settings with the data retention configuration in the platform and with any backups, since deleted analytics data can persist in backup copies. Ask your implementer to demonstrate both settings on a live site, not just in a document.

Hosting location and access logs

Document the region and data center where the analytics server and database run, who holds administrator accounts and how access is granted and reviewed. Keep the access logs for the server, the database and the admin interface, and confirm they are retained long enough for your review cycle. Any managed hosting provider in the chain belongs in this file too.

Transfer assessments for remaining processors

If any processor outside the EU still touches analytics data, such as a US-based hosting company, a support vendor with remote access or a managed backup service, keep a written transfer assessment for it. Under the EU-US Data Privacy Framework, the adequacy decision covers only US organizations on the Data Privacy Framework List, so check that status on the day of the assessment. Note that the appeal in Case C-703/25 P is pending, and record how you would respond if the decision changed.

Patch and release record

Maintain a log of the platform version in production, the date each security release was applied and the change ticket behind it. Community editions often receive security fixes only when the operator installs them, so a stale version is itself a finding. Subscribe to the project's release notifications and confirm the current support status with the vendor before each review.

Questions buyers ask before choosing a self-hosted GA4 alternative

Does self-hosted Matomo remove the need for a cookie banner?

Not automatically. Matomo can run without a consent banner for analytics only in France when it is configured to the conditions in CNIL sheet 16, and the exemption depends on how the site uses it. The conditions include limiting purposes to audience measurement and A/B testing, a single publisher scope, no cross-checking with other processing, truncating the last byte of the IP address and a tracker lifetime of at most 13 months. Matomo's own ePrivacy guidance says adding User ID, heatmaps or session recordings removes the exemption. Confirm the rules your national authority applies with your legal team before you drop the banner, because Matomo's FAQ notes that Italy, the Netherlands and Spain follow the CNIL approach only when their criteria are met.

What are the cost components of self-hosting Matomo or Plausible?

Self-hosting has four main cost components: infrastructure, labor, premium add-ons and upgrades. The Matomo On-Premise Community edition is free to license, so the spend is servers, storage, backups, monitoring, staff time and any paid plugins. Matomo's requirements FAQ sizes a single server with at least 4 CPUs, 8 GB of RAM and 250 GB of SSD for up to 1 million pageviews a month, and recommends separate app and database servers with 8 CPUs and 16 GB of RAM each for up to 10 million pageviews a month. The Heatmap and Session Recording plugin is a paid premium plugin sold per number of users. Infrastructure and plugin costs scale with traffic and headcount, while setup and upgrade work recur with each release. Ask any provider for a quote that separates one-time setup from monthly operating costs.

How long does a migration take, and what can the GA importer not carry?

The duration depends on the number of properties, the tag changes, the consent setup and how much history you want to keep, so confirm an estimate against your own site inventory. The Google Analytics Importer for Matomo is free and imports aggregated report data, not raw visit and action data. Matomo's FAQ states that the Visitor Log, Ecommerce Log, Custom Reports and Segmentation do not work for imported reports, and that some reports such as Funnels are not imported. Plausible's GA4 import brings in daily aggregates, cannot import ecommerce revenue, and approximates unique visitors by summing daily uniques. Plan to run both tools in parallel before cutover, and document which historical reports your stakeholders still need.

Can our team run self-hosted analytics without outside help?

A team with Linux, web server, database and container experience can run Matomo or Plausible Community Edition, but the work does not stop at installation. Plausible's self-hosted page states that Community Edition operators manage installation, upgrades, capacity, uptime, backups and security themselves, and that security fixes arrive only when the operator applies the release. Matomo requires PHP 8.1 or newer and MySQL 8.0 or newer or MariaDB 10.6 or newer for version 6.0.0, so older stacks need planning. Ask yourself who will apply upgrades, own the database, handle restores and watch tracking health after each change. Plausible Community Edition also has community support only, which affects how fast you get help when something breaks.

Does the EU-US Data Privacy Framework still matter for our analytics?

Yes, because the framework changes the legal basis for transfers without removing the risk you are trying to avoid. The European Commission adopted the adequacy decision on July 10, 2023 (Decision 2023/1795), which applies only to US organizations on the Data Privacy Framework List. The decision is under challenge: an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. US law such as the CLOUD Act can still reach data held by US providers, which is why many EU organizations keep analytics data in the EU on infrastructure they control. Have counsel review the current status of the framework and your transfer assessment before you decide.

What should we ask for in a quote for a self-hosted analytics project?

Ask for a written scope that lists the properties, sites, pageview volumes, data sources and the features you need, because these drive server sizing and effort. Request a separate line for infrastructure, implementation and tracker changes, consent configuration, historical import, testing, documentation and handover. Ask which items recur, such as upgrades, backups, monitoring and support, and what each one covers. Confirm which plugins are required and whether any are paid, such as Matomo's premium heatmap and session recording plugin. DeployOpen does not publish a price list. Fixed-scope work is agreed in writing before it starts, and ongoing support, upgrades and testing are available as retainers.

Does Google Analytics store EU visitor data only in Europe?

Google states that Google Analytics collects data from EU, Swiss and UK devices on servers in those regions and drops IP addresses before logging, before forwarding data for processing. That description covers collection and initial handling, not every later processing step, so it does not settle whether your full data flow stays in the EU. Confirm with Google and your own records which processing locations apply to your property and which features you use. For a regulated organization, the question is what your data processing terms and transfer documentation actually cover, and whether you can show that control to an auditor.

How DeployOpen deploys analytics under a residency constraint

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For EU residency work, we start from a written scope that defines where analytics data is stored, who can reach it and which consent conditions the chosen tool must meet.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The scope names the analytics tool, the hosting location, the sites or apps covered and the data fields collected.
We record which consent conditions your legal and privacy team needs to confirm, such as CNIL sheet 16 for France.

How we build

We install the chosen platform, such as Matomo, inside your own infrastructure and configure it to the agreed scope.
We set IP truncation, retention periods and tracker settings to match the conditions your team has confirmed.
We test tracking on staging before rollout, including checks that no features outside the agreed scope are enabled.

How we hand over

We document the architecture, data flows, configuration decisions and access controls for your records.
We prepare evidence of settings and controls that your auditors or privacy team can review, without issuing any certification.
We provide runbooks for backups, upgrades and recovery, so your operators can run the platform after handover.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build.
Upgrades are planned and tested against the version your team runs, so security releases are applied on a schedule.
Your legal counsel remains responsible for transfer assessments and consent decisions, and we advise on the technical facts.