Does Umami require a cookie banner under GDPR?

In most EU readings, no. Umami sets no cookies, stores no IP addresses and does not identify visitors, so it can rely on the legitimate interest legal basis under GDPR. Some supervisory authorities are stricter — Germany (TTDSG) and Italy (Garante) recommend disclosure — but most, including the CNIL in France and the ICO in the UK, accept its use without prior consent when the tool anonymises data by design, which Umami does.

What is the difference between Umami Cloud and self-hosted Umami?

Umami Cloud is the SaaS version at umami.is; your data lives on their servers. Self-hosted Umami runs on your own server and your data never leaves your infrastructure. Both versions share the same dashboard and features because it is the same open-source platform (MIT licence), with no feature gating.

How does the Umami script compare to GA4 in size?

Umami's tracking script is under 2 KB. Google's gtag.js weighs around 50 KB. The difference is measurable on Core Web Vitals, particularly LCP and TBT on mobile.

Can I run Umami and GA4 in parallel?

Yes, and that is the recommended approach during migration. Dual tracking for around 30 days lets you calibrate the difference. Umami usually reports significantly more visitors than GA4 because it does not depend on cookie consent.

What happens to Google Ads remarketing if I drop GA4?

Umami has no native integration with Google Ads or Meta Ads. If remarketing is central to your acquisition, the sensible path is to keep GA4 for advertising only and use Umami for traffic and behaviour analytics. If you don't run remarketing campaigns, you can drop GA4 without losing anything useful.

What does VANTAG's managed Umami service include?

Self-hosted Umami on a dedicated EU server (Frankfurt or Madrid), version upgrades, encrypted daily backups, uptime monitoring, custom subdomain (analytics.yourdomain.com) and GA4 migration. A white-label option is available for agencies serving their own clients.

Umami vs Google Analytics 4: why European sites should move to cookieless analytics in 2026

If you’re running Google Analytics 4, the rules changed on 15 June 2026. Google removed the separation between analytics data and Google Signals advertising data, which means your cookie banner is now the only firewall between your visitors and Google Ads. If the banner isn’t properly configured — and on most European sites it isn’t — you’re exposed to complaints under GDPR and to your national supervisory authority (AEPD in Spain, CNIL in France, Garante in Italy, ICO in the UK, BfDI in Germany).

Umami solves the problem by design: no cookies, no IP storage, no personal identification, no third-party data transfer. In most EU readings, that means you can drop the analytics cookie banner altogether.

What Umami is

Umami is an open-source web analytics platform (MIT licence) built by Umami Software. It launched in 2020 with a clear goal: give websites the metrics they actually need — visits, page views, referrers, countries, devices, events — without collecting personal data.

Two ways to run it:

Umami Cloud: the SaaS version at umami.is. Easy to sign up for, but your data lives on their servers.
Umami self-hosted: you install it on your own server. Your data never leaves your infrastructure. This is what VANTAG offers as a managed service.

The tracking script is under 2 KB. It doesn’t slow the site down or hurt Core Web Vitals — a well-documented issue with gtag.js on mobile.

Why GA4 has become a legal liability in the EU

GDPR itself hasn’t changed, but the interpretation has tightened. The European Data Protection Board (EDPB) issued updated cookie guidelines that national authorities are now enforcing more consistently. Three points that most sites are getting wrong:

“Accept” and “Reject” buttons with equal visibility. “Dark patterns” — reject hidden in a submenu, or requiring more clicks — are actively being sanctioned across the EU. CNIL alone has issued nine-figure fines to Google and Facebook over this exact issue.
Real prior consent. No cookies fired before the user accepts. Google Consent Mode v2 in basic mode, not advanced, if your implementation is compliant.
From 15 June 2026, the ad_storage parameter can’t be granted by default. If it is, GA4 feeds Google Ads without consent.

The issue isn’t GA4 in isolation, it’s the ecosystem it drags along. If you want to comply strictly, you end up with an intrusive banner, low acceptance rates (typically 30-40%) and incomplete data. And even then, a policy change from Google can push you out of compliance without warning.

With Umami you don’t have that front open. No cookies to consent to, no data flowing to ad platforms, no dependency on a third party’s policy decisions.

Umami vs GA4: technical comparison

	Umami	GA4
Cookies	None	`_ga`, `_gid`, plus Google Signals
Analytics cookie banner	Not required in most EU jurisdictions	Required with prior consent
Data storage	Your server (self-hosted)	Google servers (typically US)
Script size	< 2 KB	~50 KB (gtag.js)
Sampling	None	Aggressive sampling on large accounts
Data retention	You decide	14 months max on free tier
Data export	Direct PostgreSQL/MySQL access	BigQuery only (metered pricing)
Learning curve	Low: simple dashboard	High: reworked UI, complex event model
Ad platform integration	None	Yes (Google Ads, DV360)
Cost	Free (self-hosted) or from $9/month (cloud)	Free up to 10 M events/month

Umami isn’t GA4. If your business runs on Google Ads remarketing, GA4 still makes sense for you. If you’re a company site, an e-commerce without aggressive retargeting, a publisher, a SaaS or any project where you just need to know what works, Umami covers 95% of the use case with a fraction of the complexity.

What Umami doesn’t do (worth knowing before you migrate)

An honest counter-argument: if you’re going to migrate, know the limits.

No cross-device user ID. With no cookies or persistent identifiers, the same user on mobile and desktop counts as two separate visitors.
No native integration with Google Ads or Meta. If you need campaign attribution, you’ll have to combine Umami with server-side tagging or keep GA4 for advertising only.
Funnels and cohorts are more limited than in GA4 or Amplitude. If your day job is advanced product analytics, Umami falls short.
No machine learning or predictive metrics. Umami tells you what happened, not what’s going to happen.

For 90% of corporate sites, e-commerce and publishers, these limitations don’t matter. For a growth team running complex funnels on a SaaS, they do.

How to migrate from GA4 to Umami without losing data

The common mistake is switching GA4 off the day you plug Umami in. Bad idea. Do it in phases:

Phase 1 (month 1): dual tracking. Install Umami without touching GA4. Both running side by side. Compare metrics for 30 days to calibrate the difference. Umami typically reports 20-40% more visitors than GA4 because it doesn’t depend on cookie consent.

Phase 2 (month 2): event mapping. Migrate the events that matter (form submissions, WhatsApp clicks, downloads, scroll to X%). Umami events are one line of JavaScript:

umami.track('contact-sent', { source: 'services-landing' });

Phase 3 (month 3): historical export and GA4 shutdown. Export the GA4 history you want to keep (to BigQuery or CSV) and switch it off. From here, you drop Google Consent Mode and simplify the cookie banner.

What VANTAG offers

Self-hosted Umami is free, but running a production instance has a real cost: server, upgrades, backups, monitoring, PostgreSQL tuning when traffic grows. If you’d rather not have your team handle that, we do.

Umami managed by VANTAG includes:

Installation on a dedicated EU server (Frankfurt or Madrid, your call).
Version upgrades and security patches.
Encrypted daily database backups.
Uptime monitoring with under-5-minute alerting.
Custom dashboard on your own domain (for example analytics.yourdomain.com).
GA4 migration included: we import history where possible, define events and leave your site with a clean consent setup.

Three profiles we work with:

SMBs and e-commerce that want to stop depending on the cookie banner and the risk of a supervisory-authority complaint.
Agencies and studios that want to offer analytics to their clients without running the infrastructure themselves. White-label available.
Publishers and media that need reliable metrics without analytics costing them Core Web Vitals points.

Is the move worth it?

If your revenue depends on Google Ads and remarketing is 70% of your acquisition, stay on GA4 and fix the consent implementation properly.

For everything else, migrate. You’ll get more honest metrics (without the cookie-rejection filter), a faster site, no intrusive banner and an analytics provider that can’t rewrite the rules on you overnight.

If you’d like us to run it for you, get in touch. We audit your current GA4 setup at no cost, tell you honestly whether the switch is worth it, and if it is, we quote a fixed price.