Privacy-Friendly Analytics: A UK Small Business Guide

Privacy-friendly analytics measures how people use your website without cookies, without persistent identifiers and without following anyone from site to site. You still see visits, popular pages, traffic sources and devices. Your visitors are not profiled, and for many sites you can drop the tracking part of the cookie banner. This guide explains how it works, what UK rules actually say, what you give up, and how to pick a tool without wasting a weekend on it.

No Worry Websites

Build a Website That’s Easier to Run

No Worry Websites creates custom websites for small businesses, with ongoing support and monthly changes to help keep your site up to date.

Explore website services

TL;DR

Cookie-free analytics counts visits using a short-lived, one-way hash of technical details, so it needs no cookie and stores no raw IP address.
You still get the numbers a small business uses: page views, unique visitors per day, sources, top pages, devices and conversions.
“No cookies” does not automatically mean “no consent and no GDPR duties”. You still need clear privacy information, and the UK exception for statistics has conditions.
You lose long customer journeys, cross-day tracking and remarketing audiences. For most small sites that is a small price.
Choose on setup, reports you will read, export and deletion, and cost. Then say what you do in your privacy policy.

What privacy-friendly analytics actually means
What you can still see
What the UK rules say
What you give up
How to choose a tool
A simple five-step setup
Perspective
Make it part of a site that is easy to run
Mistakes to avoid
Is it worth it for a small business?
FAQ
Sources

What privacy-friendly analytics actually means

Traditional analytics drops a cookie in the visitor’s browser. That cookie recognises the same person on their next visit, and often links their behaviour across other sites. Privacy-friendly tools take a different route. They measure the site, not the person.

The Information Commissioner’s Office describes cookies as small text files created by a web server, which a device can store and send back on the next request. They can run logins and shopping baskets, but also traffic analysis and tracking of browsing behaviour. That last use is what privacy-friendly analytics avoids.

So when people search for cookie-free analytics, GDPR-compliant analytics or analytics without cookies, they are usually asking for the same thing: useful traffic numbers with as little personal data as possible.

How cookieless counting works

The common method is a daily hash. One widely used approach combines the IP address and browser details with a salt that is deleted every 24 hours. It uses that to estimate unique visitors, never stores the raw IP address, and cannot follow a person across websites or days.

A UK-based tool describes much the same idea: nothing is stored in cookies or browser storage, and a one-way daily hash is built from a daily salt, a site ID, the IP address and the browser string. The raw network data is used in memory only, and the salt is thrown away after the day ends.

In plain terms: the tool can tell that 140 different devices visited today, but it cannot say that the same device came back on Thursday.

What you can still see

The worry most owners have is that cookie-free means flying blind. It does not. One privacy-focused tool reports page views, unique visitors, referral sources, top pages, countries, devices and browsers, with data isolated to one device, one website and one day.

A UK cookie-free tool goes a little further, listing live visitors, bounce rate, visit duration, scroll depth, engaged time, entry and exit pages, UTM campaigns, goals and alerts without cookies or stored IP addresses. Another guide adds that these tools can reliably measure traffic sources, including AI assistants, city-level geography and custom conversion events.

For a local business, that covers the questions that matter:

Which pages do people read before they enquire?
Did the leaflet, Google listing or social post send anyone?
Do most visitors use a phone?
How many people clicked “call” or submitted the contact form?

If you want a sense of whether the visits are turning into money, pair these numbers with our guide to working out what your website earns, and compare your form conversion with UK conversion rate benchmarks.

What the UK rules say

This is the part people get wrong in both directions, so take it slowly.

PECR covers more than cookies

The Privacy and Electronic Communications Regulations (PECR) apply to any technology that stores information on a user’s device or accesses information stored there. That is why the ICO talks about “storage and access technologies” rather than just cookies. A tool that sets no cookie and writes nothing to local storage starts from a much simpler position, but you should still check what the script does.

The statistics exception

UK law now has a specific allowance for statistics. According to one analysis, since 5 February 2026 storage or access for statistical purposes is permitted if the sole purpose is collecting statistics to improve the service, the information is not shared onward, and users get clear information and a simple, free way to object. The ICO’s guidance also notes that for analytics under this exception, users must be able to object.

So a cookie-free, first-party, statistics-only setup can often run without a consent pop-up, provided you tell people and give them an easy opt-out. Check the ICO’s current guidance before you decide, because it is the regulator’s reading that counts.

Advertising measurement is different

If you run paid ads and want to measure their effectiveness with tracking technologies, the picture changes. The ICO says that storage and access for online advertising, including campaign-effectiveness measurement, needs consent, although measurement does not need separate consent when it is covered by the consent given for advertising. If paid campaigns are a big part of your plans, read up on digital advertising for local businesses and how to measure results while keeping tracking and consent requirements modest.

“Cookieless” does not mean “data-free”. One UK vendor’s own technical guidance stresses that no cookies is not the same as no data processing or no personal data. Businesses should check whether a tool uses persistent identifiers or fingerprints, how raw network data is handled, what fields are kept, and whether session replay or user IDs are switched on.

Your privacy information must also cover what the ICO lists: the purposes of processing, the lawful basis, retention periods and any data transfers. If you do not have a privacy policy that says this, our walkthrough on how to write a privacy policy in 20 minutes is a sensible first job.

The scale matters too. The ICO’s own impact assessment estimates that nearly all UK internet users, around 57 million people, are likely to meet these technologies. Regulators are paying attention, and small sites are not invisible.

What you give up

Honest trade-offs help you choose well. With cookie-free analytics you should expect to lose individual cross-day journeys, long-window attribution and remarketing built on persistent tracking.

In practice that means:

A returning visitor on Monday and Thursday counts as two visitors, not one.
You can see that people click “book now”, but not trace one person’s path over three visits to the final enquiry.
You cannot build ad audiences from your site visitors.

For a plumber, a salon, a consultancy or a café, those are rarely the questions that grow the business. You mostly need to know what brings people in and what makes them get in touch. One advantage worth weighing: when someone rejects a traditional cookie banner, they vanish from your numbers. A cookieless tool avoids that, because it bypasses what one vendor calls the consent tax, where a large share of visitors goes unmeasured.

How to choose a tool

You do not need to compare thirty products. Work through these criteria in order.

What to check	Why it matters	What good looks like
Cookies and storage	Decides your PECR position	No cookies, no local storage, no fingerprinting
IP address handling	Decides whether you hold personal data	Raw IP never stored, daily salt deleted
Data location and ownership	Affects transfers and your privacy policy	Clear statement of where data sits and who processes it
Reports you will read	A dashboard nobody opens is wasted money	Sources, top pages, devices, goals on one screen
Goals and events	You need to count enquiries, calls and bookings	Simple button and form tracking without code
Export and deletion	You may need to answer a data request	Easy CSV export and delete controls
Cost	Small sites should not pay enterprise prices	Predictable monthly or yearly price

What it costs

As of August 2026, one comparison puts entry-level hosted plans at around $9 a month at the cheaper end, about $15 a month for a mid-range option covering up to 50 sites, and cloud plans from around €29 a month, with a free self-hosted route as well. Self-hosting is free in licence terms, but you pay in time, server costs and upkeep. Some advanced features such as heatmaps and session recordings can also come as paid add-ons costing roughly €199 to €229 a year each.

Prices change and are quoted in dollars or euros, so check the provider’s own pricing page for the figure in pounds before you commit.

Keep features switched off

Whatever you pick, leave off anything that identifies individuals: session replay, user IDs, and any feature that stores an identifier in the browser. The moment you turn those on, you are back to needing a fuller privacy assessment.

A simple five-step setup

Decide your questions. Write down three: where do visitors come from, which pages lead to enquiries, and what share use mobile.
Pick a tool that sets no cookies and keeps raw IP addresses out of storage.
Add the tracking script to your site, or ask whoever looks after your site to do it.
Set up goals for the contact form, phone number clicks, and booking button.
Update your privacy policy and cookie information so they describe the tool, the purpose (statistics to improve your site), and how people can object. Our guide to fixing a small business homepage, cookies and accessibility covers the visible side of this.

Then leave it for a month before changing anything. Small sites give noisy numbers over a few days.

Perspective

We build websites for small businesses, and the same worry keeps coming up: “I need to know it is working, but I do not want to bury my visitors in pop-ups.” Privacy-friendly analytics answers both.

Most of our customers do not need an audience-building machine. They need to know whether the page that explains their service is read, and whether the contact form is used. A simple, cookie-free report does that, and it is far easier to explain in a privacy policy.

This is also where having someone who manages your site matters. Analytics is not a one-off script: goals need setting up, pages change, and the wording in your policy must keep matching what the site does. With our plans, you have direct access to the person looking after your site, and monthly changes are handled for you, so the details do not slip.

Our advice is to start light, measure the handful of things that lead to enquiries, and only add complexity when a real question demands it.

Mark Jones

Make it part of a site that is easy to run

Measurement works best when the site underneath is solid. A slow page or a layout that breaks on phones will hurt your numbers more than any choice of tracking method, so run our five-minute responsive audit, and keep the basics covered with a small business website security plan.

If you do not yet have a site, or yours is dated, we build custom pay-monthly websites with no upfront cost. Plans run from £34.99 a month for an 8 page website to £99.99 a month for 35 pages, with a free domain name and SSL certificate, ongoing changes and personal support. Hosting and maintenance for an existing site starts at £10 a month for 1 to 9 pages. See the pay-monthly website plans for the full list.

If the site already exists and just needs tweaks, such as adding a script or updating a policy page, our existing-website ad hoc plans cost £29.99 a month for one hour and £39.99 a month for two hours.

Mistakes to avoid

Assuming no cookies means no rules. You still need clear privacy information and an easy way for people to object.
Switching on extras. Session replay and user IDs bring personal data back.
Mixing in advertising tracking. If you add ad pixels, consent for advertising comes into play.
Never updating your policy. Your privacy page should describe what your site does today, not what it did when it was launched.
Judging too early. A week of numbers on a small site tells you little.
Collecting everything. More data is not better data. Track only what you will act on.

Is it worth it for a small business?

One practical view in the research is that for most European small businesses doing aggregate traffic and campaign analysis, the loss from going cookieless is small and the simplification is significant. That matches what we see: owners who track fewer things, understand them, and actually act on them.

The next step is simple. Pick a tool, count your enquiries, check your privacy policy matches, and review the numbers once a month.

FAQ

It can be, but the absence of cookies alone does not make it so. You must check whether the tool uses persistent identifiers or fingerprints, how it handles IP addresses and which fields it keeps. You must also give clear privacy information covering purpose, lawful basis and retention.

Not necessarily. UK law allows statistics-only storage or access without consent if the information is not shared onward and people get clear information and a simple, free way to object. If you also run advertising tracking, consent is likely needed, so check the ICO’s current guidance for your setup.

What can I still measure without cookies?

You can measure page views, daily unique visitors, referral sources, top pages, countries, devices, browsers and conversion goals such as form submissions. What you lose is following one person across several days or visits.

How much does privacy-friendly analytics cost?

Hosted tools typically start at around $9 to €29 a month depending on the provider, as of August 2026, and self-hosted options can be free in licence cost but take time to run. Check the provider’s pricing page for current prices in pounds.

Can you add analytics to my website for me?

If you are on one of our plans, ask your site manager about adding a cookie-free script and updating your policy wording. Our monthly changes and personal support are designed for exactly this kind of job.

Sources

Ready to stop worrying about your website?

Book a free, no obligation 15 minute call and we will talk you through the best option for your business.

Privacy-Friendly Analytics: A UK Small Business Guide

TL;DR

Table of Contents