Most German websites measure their traffic with a tool that requires a consent banner, and then lose 40 to 60 percent of their data to that banner. There is a calmer way to run analytics, and for many SMBs it produces better decisions with less legal exposure.
Why the banner costs you more than you think
Under Paragraph 25 of the German TDDDG, storing or reading information on a device needs consent unless it is strictly necessary. Google Analytics 4 falls under that rule. Typical German consent rates sit between 45 and 70 percent, so your reports describe a skewed sample, and the skew is not random: privacy-conscious and mobile users are underrepresented.
The realistic alternatives
- Matomo, self-hosted on a German server, from 0 EUR licence plus roughly 30 EUR per month of hosting and maintenance.
- Plausible or Fathom in EU hosting, 9 to 39 EUR per month, cookieless by design.
- Server-side log analysis with GoAccess, effectively free, but weak on user journeys.
- Matomo Cloud in Germany, from 26 EUR per month if you would rather not operate it.
Plausible and Fathom work without cookies and without storing a device identifier, which in most configurations removes the need for a consent banner for analytics. Matomo can be operated consent-free too, but only in a specific configuration: anonymised IP, no cookies, no cross-site data, and an opt-out that actually works. Several German authorities have described this configuration as acceptable, though no setup is exempt from your own documentation duty.
What you give up
Be honest about the trade. Without cross-session identifiers you lose reliable returning-visitor metrics and multi-touch attribution across weeks. You also lose the direct link into Google Ads for conversion import, which matters if you spend heavily on search. What you keep is everything that drives most decisions: which pages bring visitors, which content holds attention, which forms are completed, and where people leave. For advertising accounts there is a middle path: keep consent-based conversion tracking on the campaign landing pages only, and measure the rest of the site without cookies.
A complete picture of 100 percent of visits beats a detailed picture of 55 percent of them.
A setup that works in practice
- Cookieless analytics for the whole site, running without consent.
- Consent-gated conversion tracking only on the pages that feed paid campaigns.
- Server-side event collection for form submissions, so ad blockers do not distort lead counts.
- Search Console connected for organic queries, which no analytics tool can replace.
- A quarterly report combining all three sources instead of one dashboard nobody opens.
Documentation you will need anyway
Whatever you choose, three documents have to exist: an entry in the record of processing activities, a data processing agreement with the provider if it is not self-hosted, and a privacy policy section naming the tool, the data collected and the retention period. Retention of twelve to fourteen months is defensible; indefinite retention is not.
Migration in one afternoon
Run both systems in parallel for four weeks. Compare sessions and conversions daily and note the ratio, because the new tool will show different absolute numbers by definition. Once you understand the offset, rebuild your reporting on the new baseline and switch the old tag off. Keep an export of the historical data before you delete the property.
The typical effort for a mid-sized site is one to two days of work, or 900 to 2,400 EUR. Compared with the cost of a data protection complaint and the ongoing distortion of consent-based data, that is a straightforward decision. One more benefit is rarely mentioned: a cookieless setup removes the banner from the first screen, which measurably improves both bounce rate and the perceived quality of the site.
