Fathom Analytics

No. In its default configuration, Fathom Analytics does not set any first party or third party cookies, and it does not read any cookies from the visitor browser. Instead, Fathom uses a daily rotating salt hashed with the visitor IP address, user agent, and site ID to deduplicate visits anonymously within a single day. Because nothing is stored on the user device, the cookie law and ePrivacy storage rules are not triggered.

In most European jurisdictions you do not need a consent banner for Fathom Analytics, because no information is stored on or read from the visitor terminal and no personal data is processed in the default mode. The CNIL, the ICO, and several other supervisory authorities accept strictly anonymous audience measurement as exempt from prior consent. We recommend listing Fathom in your privacy notice for transparency, but a consent toggle is generally not required.

To the extent that the GDPR applies, the legal basis is Article 6(1)(f), legitimate interest. Recital 49 recognises measurement and security of information systems as a legitimate interest of the controller. The legitimate interest assessment is straightforward because Fathom does not persist identifiers, does not profile users, does not enable cross site tracking, and does not allow the singling out of individuals.

Only if you do not enable EU Isolation. With EU Isolation activated on your site, European visitor traffic is processed exclusively on Fathom servers located in Frankfurt, Germany, and never crosses the Atlantic. Without EU Isolation, anonymous aggregated analytics may be processed on Fathom infrastructure in the United States, in which case standard contractual clauses and the EU US Data Privacy Framework apply.

A full data protection impact assessment is not required for Fathom in its default configuration. The processing is low risk: no personal data is collected, no cookies are set, no profiling occurs, and visitors cannot be re identified. A short entry in your Article 30 record of processing activities, noting the legitimate interest basis and whether EU Isolation is enabled, is sufficient documentation for accountability purposes.

Add a single script tag pointing to cdn.usefathom.com with your unique site identifier in the head of your pages. Because the default mode is cookieless and consent exempt, the script can load unconditionally on every page load, including the first visit. If your audience is European, enable EU Isolation in the Fathom dashboard so that traffic is routed through the Frankfurt servers.

Comparable privacy first, cookieless analytics tools include Plausible Analytics (EU hosted in Germany), Simple Analytics (EU hosted in the Netherlands), and Matomo (self hosted or EU cloud). All four follow a similar consent exempt design pattern. The right choice depends on hosting location, pricing, integrations, and whether you prefer self hosting or a managed service.

Strictly speaking, a cookie policy entry is not required because Fathom does not set cookies. However, a short mention in the privacy notice or analytics section is recommended for full transparency. State that Fathom Analytics is used for anonymous, cookieless audience measurement, that EU Isolation is enabled where applicable, and that no personal data is processed.