FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Analytics

Open Web Analytics

Analytics

Open Web Analytics (OWA) is a free open source web analytics platform written in PHP and MySQL. Maintained by Peter Adams, it is self hosted and offers pageview tracking, sessions, click maps, heatmaps and DOM event recording, comparable to Matomo on premises.

Block Open Web Analytics until consentScan my site
Overview

What does Open Web Analytics do?

What Open Web Analytics is

Open Web Analytics, often called OWA, is a free open source web analytics platform written in PHP with a MySQL database. It is maintained by Peter Adams under a GPL licence and is installed on the operator's own server, typically alongside the website it measures. OWA tracks pageviews, sessions, referrers, clicks, mouse movements, scroll depth, DOM events and supports a Matomo style dashboard. It is a popular alternative for organisations that want full control over their analytics stack.

Data and cookies involved

By default the JavaScript tracker writes two first party cookies on the website's own domain: owa_v, a persistent visitor identifier, and owa_s, a short lived session cookie. The tracker can also collect IP addresses, screen size, user agent, referrer, mouse coordinates for heatmaps and DOM events. All of this is stored in the operator's MySQL database, never sent to a third party by OWA itself.

GDPR and ePrivacy implications

Even when the data stays on the controller's servers, writing or reading the owa_v cookie still triggers Art 5(3) of the ePrivacy Directive. The cookie is first party, but it is not strictly necessary to deliver the requested service. Under Art 4 GDPR the IP address and visitor identifiers are personal data. Operators must therefore choose a lawful basis under Art 6 and decide whether the cookies need consent or fall under a national exemption.

Consent and CNIL exemption

In the default configuration with heatmaps, persistent cookies and full IPs, OWA needs prior consent under Art 6(1)(a) GDPR. A simpler setup, with IP anonymisation, no cross site tracking, short retention and no fingerprinting, can qualify for the CNIL measurement exemption that mirrors the EDPB analytics guidance. Operators must document which configuration they run and why.

Data residency and transfers

Because OWA is self hosted, there is no built in transfer to a third country. Data location simply follows the hosting provider. EU hosted OWA stays in the EU and avoids Chapter V GDPR. If the operator runs OWA on a US cloud provider that qualifies as an importer, Standard Contractual Clauses and a Transfer Impact Assessment become necessary.

Practical compliance setup

Pick an EU host, enable IP anonymisation, set a short retention window for raw logs, disable heatmaps when not strictly needed, and gate the JavaScript tracker behind your consent banner unless your configuration matches the local analytics exemption. Document OWA in the records of processing under Art 30 and mention it in the privacy notice as a first party measurement tool.

Compliance

Open Web Analytics and the GDPR

Open Web Analytics is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art 6(1)(a) GDPR) when OWA is used in its default behavioural mode with persistent cookies, heatmaps and DOM event tracking. Legitimate interest (Art 6(1)(f)) is acceptable only in a strict, cookieless, IP anonymised configuration that meets the CNIL exemption criteria.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, German TTDSG, French Loi Informatique et Libertés and CNIL referential for cookies, Spanish LSSI and LOPDGDD, Italian Codice Privacy

Impact assessment (DPIA)

A DPIA under Art 35 GDPR is usually not mandatory when OWA is self hosted in the EU with IP anonymisation, short retention and no heatmaps. It becomes recommended if the operator activates session replay style features, mouse heatmaps, cross site tracking or stores raw IP addresses for long periods, since these patterns approach systematic monitoring.

Sample text for your banner

We use Open Web Analytics, a self hosted open source tool, to understand how visitors use this site. With your consent, we store first party cookies owa_v and owa_s on this domain to measure visits, clicks and sessions. Data stays on our own servers. You can refuse or withdraw at any time.
Cookies and trackers

What Open Web Analytics sets and contacts

Tracking method
Self hosted PHP and MySQL application using a JavaScript tracker that posts pageviews, sessions, clicks, mouse movements and DOM events to the operator's own server. First party cookies owa_v and owa_s are written on the website's own domain.
Server location
Depends on the operator. Open Web Analytics is installed on the controller's own infrastructure; data residency follows the chosen hosting provider, which can be the EU when self hosted in Europe.
Cookieless mode available
Yes

Cookies set (2)

NameTypeDurationPurpose
owa_vfirst party analyticsaround 2 yearsPersistent visitor identifier written by the OWA JavaScript tracker on the operator's own domain. Allows OWA to recognise returning visitors, link sessions to a single profile and compute audience metrics like new vs returning users.
owa_sfirst party analyticssessionShort lived session cookie set by the OWA tracker on the operator's own domain. Groups individual events and pageviews into a single visit so OWA can compute session level metrics such as duration, bounce and entry pages.

Third-party domains contacted (2)

  • openwebanalytics.com
  • github.com/Open-Web-Analytics
Questions

Frequently asked questions about Open Web Analytics

Can't find your question? Write to us, we answer fast.

What cookies does Open Web Analytics set?

OWA writes two first party cookies on the website's own domain: owa_v, a persistent visitor identifier valid for about two years, and owa_s, a session cookie. Both are stored under the operator's domain rather than a third party domain, which keeps the data inside the controller's perimeter but still triggers cookie law.

Is consent required for OWA?

In the default behavioural configuration, yes. The owa_v cookie is not strictly necessary for the service, so Art 5(3) ePrivacy applies. A stripped down setup with IP anonymisation, no cross site tracking, short retention and no fingerprinting may qualify for the analytics exemption recognised by the CNIL, the German DSK and the EDPB.

What legal basis applies?

Default configuration: consent under Art 6(1)(a) GDPR. Cookieless or exemption compliant configuration: legitimate interest under Art 6(1)(f), provided you can demonstrate balancing in a documented LIA. Either way, the legal basis must be reflected in the privacy notice and in the records of processing activities.

Are data transferred to the US?

Not by the software itself. OWA is self hosted, so data location follows the operator's servers. If you self host on EU infrastructure, no transfer takes place. If you run OWA on a US cloud provider, Standard Contractual Clauses and a Transfer Impact Assessment under Schrems II become necessary.

Is a DPIA needed for OWA?

Not systematically. A DPIA under Art 35 GDPR is recommended when OWA is configured for heatmaps, session replay style features, mouse heatmaps, long retention of raw IPs or cross site identifiers. With a basic, anonymised configuration on EU infrastructure, the Art 30 register usually suffices.

How do I implement OWA compliantly?

Host in the EU, anonymise IPs, shorten retention, disable heatmaps unless strictly required, gate the tracker behind your consent banner unless the configuration matches the exemption, document the configuration, sign appropriate processor agreements with any hosting partner and mention OWA in the privacy notice as a first party analytics tool.

What are the alternatives?

Matomo is the closest alternative, with a stronger product, an EU based company (InnoCraft, New Zealand and France), and a similar self hosted model. Plausible (Estonia) and Piwik PRO (Poland) are EU friendly options with built in consent free modes. For pure event tracking, PostHog Cloud EU or Umami are common choices.

How do I update the cookie policy?

List owa_v and owa_s as first party analytics cookies with their purpose and retention. State who hosts OWA, where the data lives, what retention applies, the legal basis chosen, and how to refuse or withdraw consent. Update the policy whenever you change the OWA configuration, retention or hosting location.

Same category

More services: Analytics

See the whole category

Totango

Totango is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Totango offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Totango empowers organizations to optimize strategy and maximize return on investment.

Analytics

Quotemedia

Quotemedia is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Quotemedia offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Quotemedia empowers organizations to optimize strategy and maximize return on investment.

Analytics

SkyGlue

SkyGlue is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. SkyGlue supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, SkyGlue enables informed decisions that improve experience and drive results.

Analytics

Adobe DTM

Adobe DTM is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Adobe DTM supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Adobe DTM enables informed decisions that improve experience and drive results.

Analytics

Ensighten

Ensighten is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Ensighten offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Ensighten empowers organizations to optimize strategy and maximize return on investment.

Analytics

Jetpack

Jetpack is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Jetpack offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Jetpack empowers organizations to optimize strategy and maximize return on investment.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site