Web Analytics
Plausible Analytics
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Plausible Insights OÜ · plausible.io
Compare with Google Analytics 4 → Compare with Simple Analytics → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Plausible Analytics at a glance
- Vendor
- Plausible Insights OÜ
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention the EU and Germany source, captured 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Plausible Analytics 2.5/5, the mean of 6 judges. Plausible Analytics, a cookieless open-source web analytics service from Plausible Insights OÜ of Tartu, Estonia, scores highest on consent and privacy (upper cluster 8–9; range 0–9): the pages publish the counting method — a daily salt hash, salt deleted every 24 hours, raw IP and User-Agent never stored — and an independent legal assessment supports consent-free analytics under GDPR, CCPA and PECR. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Plausible Analytics, a cookieless open-source web analytics service from Plausible Insights OÜ of Tartu, Estonia, scores highest on consent and privacy (upper cluster 8–9; range 0–9): the pages publish the counting method — a daily salt hash, salt deleted every 24 hours, raw IP and User-Agent never stored — and an independent legal assessment supports consent-free analytics under GDPR, CCPA and PECR. Data ownership and sovereignty follow at 8–9 and implementation at 8, resting on an automatically applicable data processing agreement, visitor data stated to be processed on servers owned by European companies and never to leave the EU, documented APIs and exports, and a 30-day trial with no credit card. Pricing transparency is weakest at 5–6: only the 10k monthly pageview band is priced, Enterprise is 'Contact us', and we found no public information on overage handling, VAT treatment or minimum terms. The clearest split is between judges, not criteria: two judges computed 0.0 on every criterion while the other persona-weighted totals run 7.4–8.0, and their rationales describe the same features and state no reason for the zeros.
Speaks for it
- Counting method published in full — a daily salt hash with the salt deleted every 24 hours, raw IP and User-Agent never stored — with an independent legal assessment backing the no-consent-banner position under GDPR, CCPA and PECR
- Data processing agreement applies automatically to all customers and includes audit rights and the right to object to subprocessor changes
- Exits documented: a read-only stats API, events and sites APIs, CSV exports, GA4 history import, Enterprise daily raw exports to S3-compatible storage, and an AGPL-licensed self-hosted edition
- Outbound links, file downloads, form submissions, 404s and scroll depth tracked automatically without code, with funnels of two to eight steps showing per-step drop-off
- Tiers public with feature allocation per plan, a 30-day trial with no credit card required, and a self-hosted edition charging no fees to the vendor
Held against it
- Pricing transparency scored 5–6: Starter is €9 /month for up to 10k monthly pageviews, Growth €14 /month, Business €19 /month, but only the 10k band is priced, Enterprise is 'Contact us', and we found no public information on overage handling, VAT treatment or minimum term
- Dashboard CSV exports hold the top 300 entries per report (100 for pages), and dashboard exports and the stats API are unavailable without an active subscription — only the site-settings export remains
- The self-hosted Community Edition is published without funnels, user journeys, e-commerce revenue goals, SSO and the sites API, and is community-supported only
- Subprocessor locations are given only for the European infrastructure providers, leaving processors such as Paddle and Postmark unlocated, and we found no public information on ISO 27001 or SOC 2 certification
- We found no public information on cohort and retention reports, compared attribution models, product-level commerce tracking, or conversions sent back to Google Ads or Meta
Best for
- You need analytics your data protection officer can accept without a cookie banner, backed by the published counting method and the independent legal assessment
- Your procurement requires a data processing agreement that applies automatically and visitor data stated to be processed on servers owned by European companies
- You manage client sites and need password-protectable shared links, email reports to unlimited recipients and a consolidated view across sites (the agency perspective scored the highest total at 8.0)
- You want a documented exit path — a reimportable site-settings export, GA4 history import and an AGPL-licensed self-hosted edition
Avoid if
- You must budget an annual cost at traffic above the 10k monthly pageview band — the captured pages publish prices only for that band, and Enterprise is a 'Contact us' plan
- You need event-level raw data outside an Enterprise plan — scheduled raw event exports are documented on Enterprise plans only
- You plan to self-host and expect the same feature set — the Community Edition is published without funnels, user journeys, e-commerce revenue goals, SSO and the sites API
- Your access must outlive a cancelled subscription — dashboard exports and the stats API are documented as unavailable without an active trial or subscription
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 3.5 of 5 |
| Goals, events, funnels & e-commerce | 3.5 of 5 |
| Consent-free operation & data minimisation | 4 of 5 |
| Data access, export & self-hosting | 4 of 5 |
| Installation, integrations & performance | 4 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3 of 5 |
Traffic, sources & campaign reports
panel disagrees
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
Pages, entry and exit pages, sources, referrers, UTM tags and channels with automatic grouping for Paid Search and Affiliates, countries through to cities, devices and browsers, a real-time view refreshing every 30 seconds, saved personal and site segments with combinable filters, annotations, a consolidated dashboard across my sites, weekly or monthly email reports and Search Console data beside the traffic. That covers nearly everything I need to judge my Google and price-comparison spend. We found no public information on custom dashboards or report builders, or on ad-platform cost data shown beside the traffic. 1 4 12 18
The Data Protection Officer
The dashboard documentation covers pages, entry and exit pages, sources, channels and UTM tags, countries, regions and cities, devices, browsers and operating systems, a real-time view refreshing every 30 seconds, saved personal and site segments, combined filters, Search Console data beside the traffic, a consolidated view across sites, annotations, and weekly or monthly email reports. Custom dashboards appear to be reached only through the Data Studio connector, channel grouping is described as automatic rather than configurable, and we found no public information stating that reports are unsampled. 1 2 4 11 12 18
The Agency Developer
The standard reports cover pages, entry and exit pages, sources, channels, UTM tags, countries, devices and a real-time view refreshing every 30 seconds, with saved segments, filters across all reports, weekly and monthly email reports to unlimited recipients, and password-protectable shared links for clients. Annotations, Search Console data beside the traffic and a consolidated roll-up across sites are also documented. We found no public information on configurable channel grouping or a stated position on report sampling. 1 2 4 9 11 12 18
The Growth Analyst
The documented dashboard covers pages, entry and exit pages, sources and referrers, UTM campaigns with automatic channel grouping, countries, regions, cities, devices and browsers, a real-time view refreshing every 30 seconds, saved personal and site segments, annotations, weekly or monthly embedded email reports, Search Console queries shown beside the traffic, and a consolidated view across sites — for a marketing site plus app plus docs subdomains that is most of what a growth team runs on. Custom dashboards are documented only through the Data Studio connector on the Business plan, and we found no public information on configurable channel grouping or a statement that reports are unsampled. 1 2 4 11 12 18
The Public-Sector Site Owner
The dashboard covers visitors, pageviews, entry and exit pages, referrers and channels, UTM campaigns with automatic channel grouping, countries, devices and browsers, plus a real-time view refreshing every 30 seconds; saved personal and site segments, annotations, a consolidated multi-site dashboard, weekly and monthly email reports and password-protectable shared links are documented. Google Search Console data appears beside the traffic, and traffic spike and drop notifications work against a user-set limit. We found no public information stating reports are unsampled, or on custom dashboards and report builders inside the product itself. 1 2 4 11 12
The Skeptic
Every report I would ask for is documented: pages, entry and exit pages, channels, sources, referrers, UTM tags, countries down to city, browsers, operating systems and devices, a real-time view updating every 30 seconds, filters with saved personal and site segments, annotations, email reports and a consolidated view across sites, with Search Console data shown alongside the traffic. Custom properties double as custom dimensions in the API, and the counting method is published (a daily hash, 30-minute session timeout). What I could not find: any statement that reports are unsampled, configurable channel grouping, or evidence that every report can be rebuilt from the raw data. 1 2 4 12 18
Goals, events, funnels & e-commerce
panel disagrees
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
Pageview goals without code changes, custom events with properties, automatic tracking of outbound links, file downloads, form submissions, 404s and scroll depth, plus funnels of 2–8 steps in sequential, flexible or strict modes with per-step drop-off — even counting a Stripe checkout detour as the same session — and revenue goals with total revenue, average order value, multi-currency support and attribution by campaign, landing page, country and device, including a WooCommerce revenue plugin and a Shopify guide. For my checkout funnel this is close to what I run reports for. We found no public information on cohorts and retention, on comparing several attribution models, or on conversions being sent back to Google Ads or Meta server to server — and the Google Analytics import comes in only as day-level aggregates, so historical order data arrives flattened. 4 13 14 17 20
The Data Protection Officer
Pageview and custom-event goals with custom properties, automatic tracking of outbound links, file downloads, form submissions, 404s and scroll depth without code changes, funnels of two to eight steps with per-step drop-off and three funnel types, revenue goals in multiple currencies filterable by source and campaign, user journeys, and setups for WordPress, WooCommerce and Shopify are all documented. We found no public information on product-level commerce tracking such as carts, checkout and orders, on cohorts and retention, on compared attribution models, or on conversions sent back to ad platforms. 1 4 13 14
The Agency Developer
Pageview goals need no code, outbound links, downloads, form submissions, scroll depth and 404s are measured automatically, and custom events carry properties. Funnels run two to eight steps with per-step drop-off and three strictness modes, revenue attaches to goals with WooCommerce and Shopify integrations plus attribution by source and campaign, and user journeys are documented. We found no public information on product-level e-commerce reports, cohorts and retention, or conversions passed back to Google Ads or Meta. 1 4 13 14 20
The Growth Analyst
Custom events with properties, pageview goals without code changes, automatic tracking of outbound links, file downloads, form submissions, 404s and scroll depth, three funnel types with per-step drop-off, revenue per step and date comparison, user journeys, and revenue attribution fully filterable by campaign and source — that covers most of the click-to-first-invoice chain I need, and funnels even keep the session across subdomains and a Stripe checkout. We found no public information on cohort or retention reports, on compared attribution models, on product-level cart and checkout tracking, or on sending conversions back to Google Ads or Meta server to server. 1 4 6 13 14
The Public-Sector Site Owner
Goals can be pageviews or custom events with properties, and outbound links, file downloads, form submissions, 404 pages and scroll depth are measured without code — the form and funnel reporting is exactly what we need for finding where residents abandon applications. Funnels run two to eight steps in three modes with per-step drop-off, date comparison and revenue at the steps, and revenue goals work with named shop systems such as WooCommerce and Shopify, with user journeys for exploring paths. We found no public information on cohort and retention analysis, comparison of attribution models, or conversions passed back to ad platforms. 13 14 4 1
The Skeptic
The documented set is broad: pageview goals without code changes, custom events with properties, outbound links, file downloads, form submissions, 404s and scroll depth tracked automatically, funnels in three types with drop-off per step and revenue per step, revenue goals filterable by source, campaign, entry page, country and device, user journeys, and WooCommerce and Shopify revenue integrations. Still missing for the top rating: product-, cart- and checkout-level e-commerce, cohort and retention reports, compared attribution models, and any way to send conversions back to Google Ads or Meta — I found no public information on those. 1 4 13 14 20
Consent-free operation & data minimisation
panel disagrees
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
No cookies, no persistent identifiers, no cross-site or cross-device tracking, and visitors counted through a published daily hash of salt, website domain, IP address and User-Agent, with the salt rotated and deleted every 24 hours and raw IPs and User-Agents never stored. The no-banner position is stated against named law (GDPR, PECR, CCPA) and backed by an independent legal assessment of consent-free analytics on the basis of legitimate interest, with data pseudonymised on arrival and anonymised within 24 hours. We found no public information on ready-made wording for my privacy policy or per-data-type retention settings — but this is the reason I would sign: my numbers stop depending on a click on accept. 3 8 9 10 15
The Data Protection Officer
The data policy lists exactly what is collected and how a visitor is counted — a daily salted hash of IP address, domain and user agent, with the salt deleted every 24 hours and the raw IP address and user agent never stored — alongside no cookies, no persistent identifiers and no cross-site or cross-device tracking, with an independent legal assessment titled "GDPR-compliant web analytics without consent" and PECR compliance cited. For my own sign-off standard I note the reading is stated against GDPR on a legitimate-interest basis, with pseudonymisation on arrival and full anonymisation within 24 hours; we found no public information on a position specific to §25 TDDDG, on retention settings per data type, or on supplied wording for the site's privacy policy. 3 9 10 15
The Agency Developer
No cookies and no persistent identifiers, with the counting method published down to the formula: a daily salted hash of IP and User-Agent, the salt deleted every 24 hours, and raw IP and User-Agent never stored. An independent legal assessment backs the consent-free position on legitimate interest, the code is open source for inspection, and the data policy documents which fields are kept. We found no public information on recognition by a named authority or retention settings per data type. 3 8 9 10 15
The Growth Analyst
Cookieless counting with the method published — a daily salt hashed with domain, IP address and user agent, salt deleted every 24 hours, raw IP and user agent never stored — plus a data policy listing exactly which fields are kept, open-source code anyone can audit, and an independent legal assessment confirming consent-free analytics under GDPR and PECR. We found no public information citing the German TDDDG paragraph or a CNIL ruling, and retention is described as the lifetime of the account rather than configurable per data type. 3 4 9 10 15
The Public-Sector Site Owner
No cookies, no persistent identifiers and no cross-site or cross-device tracking; visitors are counted with a daily hash of salt, website domain, IP address and user agent, the salt is deleted every 24 hours, and raw IP addresses and user agents are never stored — so the council would show no cookie banner. The consent-free position is stated against named law (GDPR, PECR, CCPA) and backed by an independent legal assessment by a data protection lawyer on a legitimate-interest basis, with the open-source code auditable. We found no public information naming the German provision on device access or a data protection authority's recognition of the consent-free mode, nor supplied wording for our privacy policy. 15 9 3 8 4 10
The Skeptic
This is the strongest consent-free case I can check on paper: no cookies, no persistent identifiers, no cross-site or cross-device tracking, a published counting method (daily salt hash over IP address and User-Agent, salt deleted every 24 hours, raw IP and User-Agent never stored), URL query parameters discarded except campaign and referral parameters, and an independent legal assessment by a data protection expert supporting consent-free processing under GDPR, CCPA and PECR via legitimate interest, with the code open to inspection. The gaps: no citation of §25 TDDDG or the CNIL exemption, no per-data-type retention settings, and no supplied wording for the customer's privacy policy. 3 4 9 10 15
Data access, export & self-hosting
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
The customer retains full ownership of the website data, a Stats API covers reporting while an Events API covers collection, dashboard reports export as CSV (top 300 entries per report, top 100 for pages), a site-settings export is reimportable into another Plausible site, Google Analytics 4 history can be imported, and Enterprise plans deliver daily raw event data to my own S3-compatible storage. The Community Edition is AGPL-licensed and runs on my own server, though its documented feature set omits funnels, user journeys, e-commerce revenue goals, SSO and the Sites API, so parity is partial. Deletion after subscription lapse is documented, with an export window before the dashboards are removed. 5 6 10 17 18
The Data Protection Officer
Exports are unusually well documented: a read-only stats API with full filter, operator and segment support alongside collection and site-management APIs, CSV files for every dashboard report, a site-settings export in a format that reimports into another Plausible site, daily raw event exports to the customer's own S3-compatible storage on Enterprise plans, a Google Analytics 4 import, no retention limit on the entry plan, and deletion on termination with a documented export window before the data is removed. The self-hosted Community Edition is AGPL-licensed with its own installation guide, though the vendor itself lists funnels, user journeys, revenue goals, SSO and the sites API as not part of it, so the hosted and self-hosted feature sets are not equal. 5 6 10 17 18
The Agency Developer
A documented stats API for reporting, an events API for server-side collection, dashboard CSV exports, a site export that re-imports into another Plausible site, GA4 history import and Enterprise daily raw event exports to S3-compatible storage cover our data needs. The Community Edition is AGPL-licensed with an install guide for our own servers, though the captured pages state it is published without funnels, user journeys, e-commerce revenue goals, SSO and the sites API, and dashboard CSVs hold the top 300 entries per report. Deletion on cancellation with a final export window is documented. 5 6 10 17 18
The Growth Analyst
For a nightly warehouse sync there is a scheduled raw event export delivered daily to S3-compatible object storage, plus a Stats API with filters, segments and revenue metrics and a separate Events API for collection — but the raw export is documented only on Enterprise plans with custom pricing, and the generally available exports are aggregated (one row per day per report, top 300 entries) or re-importable only into another Plausible site. The GA4 import is aggregate at day level, the self-hosted Community Edition is free under AGPLv3 with the vendor listing marketing funnels, user journeys, ecommerce revenue goals and SSO as excluded from that edition, and deletion on termination is documented with a settings export still possible after a subscription lapses. 5 6 10 17 18
The Public-Sector Site Owner
The customer retains full ownership of the website data, with a documented read-only stats API, CSV exports of every dashboard report, a site-level export that can be re-imported into another Plausible instance, historical import from Google Analytics 4, and scheduled daily raw event exports to S3-compatible storage on the Enterprise plan. The Community Edition is AGPL-licensed with an installation guide and can run on our own municipal servers in any country, though it omits funnels, user journeys, revenue goals and single sign-on, and dashboard exports and the stats API require an active subscription. Data is deleted with an export window after a subscription lapses. 6 18 17 5 10
The Skeptic
The data has exits: a documented stats API with filters, segments and custom-property dimensions, an events API and a sites API, per-report CSV exports, a site-settings export in the same format as the CSV import so it can be reimported into another Plausible site, GA4 history import, daily raw event exports to S3-compatible storage on Enterprise, and an AGPL-licensed self-hosted edition with its own install guide. But read the fine print: dashboard CSVs are capped at the top 300 entries per report (100 for pages), the raw export sits behind Enterprise, the Community Edition explicitly omits funnels, user journeys, e-commerce revenue goals, SSO and the sites API, and both dashboard export and the stats API stop working without an active subscription — only the site-settings export survives to get the data out before deletion. 5 6 10 17 18
Installation, integrations & performance
panel disagrees
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
A snippet goes into the head, the script is documented as 54 times smaller than Google Analytics with 135KB less JavaScript per visitor, and official routes exist for WordPress including WooCommerce revenue tracking, Shopify, a Google Tag Manager template, NPM, single-page-app frameworks and mobile SDKs such as Android, Flutter and Swift. Server-side tracking via the events API, a first-party script proxy to get past ad blockers, view-only and full-access team roles, single sign-on on Enterprise, an installation testing tool and a public status page showing 99.99% uptime over 90 days make this a solid operational package. We found no public information on a Shopware or TYPO3 plugin, so for my Shopware shop it is the manual snippet. 1 5 15 19 20
The Data Protection Officer
The script's weight is stated at 135KB less than Google Analytics, with an official WordPress plugin, guides for thirteen named website builders and CMSs, automatic single-page-app routing support, Android, iOS, Flutter and Qt SDKs, a Google Tag Manager template, a first-party script proxy against ad blockers, a server-side events API, view-only and guest roles, single sign-on on Enterprise, and a public status page showing 99.99% uptime over the last 90 days. We found no public information on white-label options for agencies or on published SLA and support terms. 1 4 15 19 20
The Agency Developer
The script is stated at 54 times smaller than Google Analytics, a server-side events API exists, the official WordPress plugin handles WooCommerce revenue tracking, in-dashboard stats and proxy mode, and Shopify, GTM, automatic SPA routing and mobile SDKs are documented. First-party script proxying to bypass ad blockers, a status page showing 99.99 percent uptime over the last 90 days and view-only versus full-access team roles round it out. We found no public information on a TYPO3 guide, agency white-label or SLA terms, and community plugins are explicitly not maintained by the vendor. 1 4 15 19 20
The Growth Analyst
A header snippet documented with its size (135KB less JavaScript per visitor than Google Analytics, 54 times smaller), an official WordPress plugin with WooCommerce revenue tracking, an official GTM template, guides for Shopify, Webflow, Ghost, Docusaurus and more, automatic React/Vue/Angular routing, Swift and Android SDKs, a first-party proxy to bypass ad blockers, team roles with guest access at site level, SSO on Enterprise, and a public status page with historical uptime. We found no public information on white-labeling for agencies or a published SLA. 1 4 15 19 20
The Public-Sector Site Owner
A snippet goes into the page head, stated at 135KB less JavaScript per visitor than Google Analytics, with an official WordPress plugin handling installation, WooCommerce revenue and automatic form tracking, guides for many named platforms, automatic single-page-app support, Android, Flutter and Swift SDKs, a Google Tag Manager template, a first-party script proxy and a server-side events API. Team roles, single sign-on on Enterprise, an installation testing tool and a status page with 99.99% uptime over 90 days are documented. We found no public information on published SLA terms or white-labelling for agencies. 1 19 20 4 15 5
The Skeptic
Installation is documented end to end: a head snippet with a testing tool, an official WordPress plugin with WooCommerce revenue tracking and proxy mode, guides for thirteen named platforms including Shopify, automatic single-page-app routing plus a hash-based tracker, Android, Swift, Flutter and Qt SDKs, a Google Tag Manager template, a first-party script proxy, server-side collection via the events API, team roles up to single sign-on on Enterprise, and a public status page reporting 99.99% uptime over 90 days. Script weight is stated comparatively — 135KB less JavaScript per visitor than Google Analytics. I found no published SLA, no white-label option and no named protocol for the single sign-on; the self-hosted edition comes with community support only. 1 5 19 20
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
Plausible Insights OÜ, incorporated in Estonia with registration number and VAT ID published, is the contracting entity; visitor data is processed and stored in the EU only on EU-owned infrastructure — Hetzner in Falkenstein, Germany, Bunny in Slovenia for CDN, UpCloud in Finland for databases — and the subprocessor list with locations is public alongside a data processing agreement in force automatically for all customers. An AGPL self-hosted edition documented to run on my own server keeps every visitor record in my own chain. Independent confirmation of entity, ownership and residency beyond the vendor's own pages was not available, and we found no public information on ISO 27001 or SOC 2 certifications, so I stop one step short of the top marks. 5 7 8 10 15
The Data Protection Officer
The contracting entity is Plausible Insights OÜ of Tartu, Estonia, registry code 14709274, independent and bootstrapped with no outside investors; hosting is named and European — Hetzner in Germany for infrastructure, UpCloud in Finland for databases and exports — under the stated position that all visitor data is processed on EU-owned infrastructure and never leaves the EU, with a published DPA applying automatically, audit rights, a right to object to subprocessor changes, and a self-hosted edition the customer can run on its own servers. The subprocessor list is public, but locations are given only for the European infrastructure providers, leaving the email, support and payment links — Postmark, Paddle, Help Scout, Anthropic — unlocated, and we found no public information on ISO 27001 or SOC 2 certifications. 1 5 7 8 10
The Agency Developer
The contracting entity is Plausible Insights OÜ in Tartu, Estonia, hosting is on Hetzner in Falkenstein, Germany with the database on UpCloud in Finland and the CDN on Bunny in Slovenia, and the captured pages state visitor data never leaves the EU. Subprocessors are listed with locations, the DPA applies automatically to all customers, the company is bootstrapped with no outside investors, and the self-hosted edition keeps every visitor record on our own servers. A few optional support and payment subprocessors sit outside the EU, and we found no public information on ISO 27001 or SOC 2 certification. 1 5 7 8 10
The Growth Analyst
An Estonian entity, Plausible Insights OÜ, with a full imprint (registration number, VAT number, Tartu address), self-funded with no outside investors since 2018, hosting on named German infrastructure in Falkenstein on Hetzner, visitor data stated never to leave the EU, a subprocessor list naming Bunny (Slovenia), UpCloud (Finland) and Friendly Captcha (Germany), a DPA that applies automatically to all customers, and a documented self-hosted Community Edition that keeps the records on your own servers. We found no public information on ISO 27001 or SOC 2 certification, and the captured pages list some support and payment subprocessors without their locations. 1 5 7 8 10
The Public-Sector Site Owner
The contracting entity is Plausible Insights OÜ in Tartu, Estonia with registry and VAT numbers; visitor data sits on Hetzner servers in Falkenstein, Germany with UpCloud in Finland for databases, all stated to stay in the EU on EU-owned infrastructure, and a data processing agreement is published and applies automatically — something our procurement office can sign without negotiation. Subprocessors for the visitor-data chain are listed with European locations, though payment and support services such as Paddle and Help Scout appear without theirs, and we found no public information on ISO 27001 or SOC 2 certification. The self-hosted edition keeps every record on the customer's own servers if we run it in the municipal data centre. 7 8 10 5 15
The Skeptic
The chain checks out where it matters for visitor data: the contracting entity is Plausible Insights OÜ in Tartu, Estonia (imprint with registration number 14709274), hosting is on Hetzner in Falkenstein, Germany with the statement that visitor data never leaves the EU, the CDN is Bunny in Slovenia and the database on UpCloud in Finland, and a DPA is published and applies automatically to all customers. Two reservations keep this from the top: Paddle (payments), Postmark (the email reports) and several optional processors appear on the list without a stated location, and no ISO 27001 or SOC 2 certification is claimed anywhere I read. The self-hosted Community Edition, installable on any server in any country, is the exit door — with the caveat that you also own the security patching. 1 5 7 8 10
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
Starter at €9 /month up to 10k monthly pageviews with one site, Growth at €14 /month with three sites and three team members, Business at €19 /month with ten sites, funnels, e-commerce revenue attribution and the Stats API, Enterprise as contact us, yearly billing with 2 months free, a 30-day trial without credit card, and a free self-hosted Community Edition with community support only. The feature-to-plan mapping is public (funnels and the Stats API on Business, raw event exports and SSO on Enterprise). We found no public information on what happens when traffic exceeds a tier, on VAT treatment or a minimum term, and Enterprise is a sales conversation — so I cannot compute my real annual cost at my traffic level from these pages alone. 1 5 6 14 18
The Data Protection Officer
The tiers are public with their inclusions — Starter at €9 /month for up to 10k monthly pageviews, Growth at €14 /month, Business at €19 /month, with sites and team members per plan and features such as the stats API and funnels mapped to tiers — plus a self-hosted Community Edition free of licence fees with community support only and a 30-day trial without credit card. The pricing page indicates traffic bands up to 10M+ monthly pageviews but the captured pages price only the 10k band, Enterprise is "Contact us", and we found no public information on overage handling, minimum term or VAT treatment. 1 5 14 18
The Agency Developer
Starter is €9 /month up to 10k monthly pageviews, Growth €14 /month with 3 sites and 3 team members, Business €19 /month with 10 sites, funnels, e-commerce revenue attribution and the stats API, yearly billing gives 2 months free, the trial is 30 days without a credit card, and the self-hosted edition charges no fees to the vendor beyond my own server costs. Feature gating per plan is public, but the captured pages show only the prices at the 10k pageview band, so I cannot compute the cost at higher traffic volumes. We found no public information on overage handling, extra-site pricing, minimum term or the Enterprise tier, which is listed as "Custom — Contact us". 1 5 14 18
The Growth Analyst
Starter at €9 /month with up to 10k monthly pageviews, Growth at €14 /month with 3 sites and 3 team members, Business at €19 /month with 10 sites, 10 team members, funnels, ecommerce revenue attribution and the Stats API, two months free on yearly billing, a 30-day trial without a credit card, and a free self-hosted Community Edition — the core tiers are computable for an annual budget. SSO and the scheduled raw event exports sit in an Enterprise tier quoted as "Contact us", and we found no public information on what happens when page views exceed a tier, on VAT treatment or on a minimum term. 1 5 6 14
The Public-Sector Site Owner
Starter is published at €9/month for up to 10k monthly pageviews, Growth at €14, Business at €19 with yearly billing giving 2 months free, and the site, team member and feature allocation per tier is unusually explicit — funnels and the stats API on Business, single sign-on and scheduled raw exports on Enterprise — while the self-hosted edition carries no fees to the vendor. However, what happens when traffic exceeds a tier, overage pricing and the Enterprise price are not publicly stated, and we found no public information on minimum contract terms or VAT treatment. For a 400,000-resident site I cannot yet compute our annual cost from the public pages alone. 1 14 6 5
The Skeptic
Starter at €9/month for up to 10k monthly pageviews on one site, Growth at €14/month for 3 sites, Business at €19/month for 10 sites, two months free on yearly billing, a 30-day trial with no credit card, and a self-hosted edition with no fees to the vendor. A buyer still cannot compute the full annual cost: the pageview bands for Growth and Business are not given, there is no stated overage handling, the captured pages give no VAT treatment or minimum term, and single sign-on and scheduled raw exports live on an Enterprise plan priced only as 'Custom Contact us'. 1 5 6 14 20
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Plausible Analytics
Is Plausible Analytics European?
Yes. whats-best.ai classifies Plausible Analytics as EU-Made.
Where does Plausible Analytics store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the EU and Germany as hosting locations, per the vendor’s page captured 29 Oct 2026.
Does Plausible Analytics have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Plausible Analytics?
As of 4 Nov 2026, the panel rates Matomo (4/5), Piwik PRO Analytics Suite (3.5/5) and Pirsch Analytics (3.5/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Plausible Analytics alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Hosting location, Hosting options, Legal entity, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (with pricing) plausible.io Checked 29 Oct 2026 Details →
- 2 Features page plausible.io Checked 29 Oct 2026 Details →
- 3 Features page (cookieless analytics) plausible.io Checked 29 Oct 2026 Details →
- 4 Features page (e-commerce and revenue goals) plausible.io Checked 29 Oct 2026 Details →
- 5 Features page (self-hosted edition) plausible.io Checked 29 Oct 2026 Details →
- 6 API documentation plausible.io Checked 29 Oct 2026 Details →
- 7 Legal notice plausible.io Checked 29 Oct 2026 Details →
- 8 Privacy policy plausible.io Checked 29 Oct 2026 Details →
- 9 Data policy (what is collected) plausible.io Checked 29 Oct 2026 Details →
- 10 Data processing agreement (dpa) plausible.io Checked 29 Oct 2026 Details →
- 11 Traffic, sources & campaign reports — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 12 Traffic, sources & campaign reports — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 13 Goals, events, funnels & e-commerce — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 14 Goals, events, funnels & e-commerce — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 15 Consent-free operation & data minimisation — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 16 Consent-free operation & data minimisation — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 17 Data access, export & self-hosting — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 18 Data access, export & self-hosting — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 19 Installation, integrations & performance — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 20 Installation, integrations & performance — found from sitemap plausible.io Checked 29 Oct 2026 Details →
- 21 Security / trust page — found from the homepage plausible.io Checked 1 Nov 2026 Details →
- 22 Open-source licence page — found from the homepage plausible.io Checked 1 Nov 2026 Details →