Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
GoatCounter is a privacy first, open source web analytics tool created by Martin Tournoij. The hosted version is free for non commercial use, and a self hosted EUPL licensed version is available for full control. GoatCounter is intentionally minimal: no cookies, no persistent identifiers, no IP tracking and no fingerprinting. The hosted service runs on EU infrastructure. It generally qualifies for the CNIL's analytics consent exemption when configured with default settings.
GoatCounter is a privacy first, open source web analytics tool created by Dutch developer Martin Tournoij, currently based in Ireland. It is distributed under the EUPL 1.2 licence and is available either as a hosted service (free for non commercial use under 100k page views per month, paid for higher volume or commercial use) or as a self hosted single binary written in Go. GoatCounter is intentionally minimal in scope: it counts page views and produces aggregated statistics, without trying to compete with Google Analytics on feature breadth. The minimalism is deliberate and is the basis of its privacy friendly architecture.
For each page view, GoatCounter receives the page URL, the document referrer, the user agent string (parsed into browser and OS), the screen size, and the visitor''s IP address. The IP is immediately hashed server side using a salt that rotates every 8 hours; the hash is used to count unique visitors within that 8 hour window and is then no longer reversible. No cookies are set. No persistent identifier is stored on the device or server side. No fingerprinting. The output is an aggregated dashboard of page views, referrers, browsers, countries (from IP geolocation before hashing) and devices.
Because no cookies are set and no information is stored on or retrieved from the visitor''s terminal equipment, ePrivacy Directive Art. 5(3) does not apply to GoatCounter. Under the GDPR, the legal basis is legitimate interest under Art. 6(1)(f) for the operator''s interest in operating a website and understanding aggregate traffic. The CNIL''s 2020-091 deliberation lists analytics that meet specific criteria (no cookies, no cross site identifier, aggregated output, EU residency) as exempt from prior consent; GoatCounter generally meets these criteria when used in its default configuration.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The hosted GoatCounter service runs on EU infrastructure (Germany) under the author''s control. The self hosted version is a single binary that operators run on their own infrastructure (Linux server, container, VPS). Self hosting gives full control over data residency, retention and incident response. For operators with strict data residency or sovereignty requirements, self hosting on EU infrastructure is a robust option. Self hosted installations should be backed up regularly and updated to receive security patches.
GoatCounter does not need to appear on a cookie consent banner because it does not set cookies. Some operators choose to disclose it in the privacy notice as a transparency measure, even though no consent is technically required. Operators using GoatCounter alone (without Google Analytics, Meta Pixel or other consent requiring trackers) can avoid the cookie banner entirely on many sites, which improves user experience and conversion.
Use GoatCounter in its default configuration (no IP collection, no cookies) to remain within the CNIL exemption. Document it in the record of processing under legitimate interest for security and statistics. Mention GoatCounter in the privacy notice with the data categories (URL, referrer, user agent, country, screen size) and the legal basis. Honour the Do Not Track signal as GoatCounter does by default. Configure the page view filter to exclude internal admin URLs if needed. Do not combine GoatCounter with cross site identifiers or other tracking tools unless you accept the resulting consent obligations.
Websites using GoatCounter must obtain user consent under GDPR regulations.
DPIA considerations
GoatCounter by design has minimal DPIA implications: (1) no cookies are set; (2) no persistent visitor identifier is stored; (3) IP addresses are hashed server side using a rotating salt that changes every 8 hours to count unique visitors for that day, after which the hash is no longer reversible; (4) data is hosted in the European Union; (5) only aggregated statistics are produced (page views, referrers, country, browser, screen size). The CNIL accepts this design as falling under the analytics consent exemption under its 2020-091 deliberation, provided the operator does not combine GoatCounter with other tracking products. A DPIA is generally not required.
Sample consent text
We use GoatCounter (operated from the European Union) to count visits and understand which pages are popular. GoatCounter does not place any cookies on your device, does not store your IP address (it is briefly hashed for daily unique counting and then discarded), and does not track you across sessions or sites. We collect aggregated statistics only, under our legitimate interest. No consent is required, but you can opt out via your browser's Do Not Track signal which we respect.
GoatCounter collects user analytics data — you legally need a consent banner. Try FlowConsent free.
No. GoatCounter does not set any cookies on the visitor's device. This is a deliberate design choice and a key reason why it qualifies for the CNIL analytics consent exemption.
No. Because GoatCounter does not store information on or retrieve information from the visitor's terminal, ePrivacy Art. 5(3) does not apply. The CNIL's 2020-091 deliberation accepts analytics tools that meet specific criteria (no cookies, no cross site identifier, aggregated output, EU residency) as exempt from prior consent, and GoatCounter meets those criteria in default configuration.
Legitimate interest under GDPR Art. 6(1)(f) for the operator's interest in operating the website and understanding aggregated traffic. The IP address is processed briefly under this basis to compute the daily hash for unique counting.
No. The hosted GoatCounter service runs on EU infrastructure (Germany). Self hosted installations are under the operator's control. The author has publicly committed to keeping all hosted data within the EU.
No, a DPIA is generally not required. GoatCounter's privacy by design architecture (no cookies, no persistent identifier, EU residency, aggregated output) keeps it well below the high risk threshold of GDPR Art. 35.
Use the default configuration with IP collection disabled and the standard count.js snippet. Document it in the record of processing under legitimate interest. Mention GoatCounter in the privacy notice with the data categories and the legal basis. Honour Do Not Track. Configure page view filters for admin URLs if needed. Do not combine GoatCounter with cross site identifiers or other tracking that would defeat the privacy guarantees.
Other privacy friendly analytics tools include Plausible (Estonia), Simple Analytics (Netherlands), Fathom (Canada), Pirsch (Germany), Umami (open source, US), Open Web Analytics (open source, self hosted), Matomo (France, self hosted or cloud EU) and Cabin (Canada). EU based options like Plausible, Simple Analytics and Pirsch share GoatCounter's privacy stance.
GoatCounter does not need to appear on a cookie banner because it does not set cookies. In the privacy notice, mention it as a processor (or as self hosted infrastructure) with the data categories collected (URL, referrer, user agent, country, screen size), the legal basis (legitimate interest), the retention period and the EU data location. No consent withdrawal mechanism is required, but Do Not Track is honoured automatically.