Open source web analytics tools

Web analytics, product analytics and session replay

These tools do three different jobs, and many of them combine two or all three.

• Web analytics looks at a site’s audience as a whole: visits and pageviews, popular pages, referrers, search engines and campaigns, and breakdowns by country, device and browser. It is what publishers, marketers and most site owners need. Plausible, Umami, GoatCounter and Matomo start here.
• Product analytics follows users and the actions they take inside an app, such as signing up or upgrading, and links them to a person or an account. That makes funnels, retention curves, user paths and cohorts possible. PostHog and OpenPanel are built for this, and Rybbit and Umami cover part of it.
• Session replay and heatmaps show why people behave as they do rather than how many do: a replay rebuilds a single visit, and a heatmap adds up clicks and scrolling on a page. Because they record what is on screen, they need careful masking of personal data.

Start from the job you actually need. A blog does not need funnels, and a SaaS product will soon outgrow a pageview counter.

Cookies and consent in the EU

Article 5(3) of the EU ePrivacy Directive requires consent before a site stores or reads information on a visitor’s device, such as cookies or local storage, unless it is strictly necessary for a service the visitor asked for. Analytics is not one of the exceptions in the Directive itself, and each country applies the rule through its own law. The European Data Protection Board’s guidelines of October 2024 make clear the rule is not limited to cookies: tracking pixels, URL tracking and unique identifiers can fall under it too.

Some regulators allow audience measurement without consent under strict conditions. The French CNIL, for example, exempts analytics trackers only if they are used solely to measure the site’s own audience for the publisher, produce anonymous statistics only, are not combined with other data or passed to third parties in identifiable form, and do not follow people across sites. It also recommends limiting tracker lifetime to about 13 months and keeping the data for no more than 25 months, and it does not certify products: a vendor cannot call a tool “approved by the CNIL”.

This is why so many tools in this category avoid cookies and reset their visitor identifiers daily. A cookieless tool makes an exemption easier to meet, but it does not decide the question for you: the law where your visitors are, your configuration and the other scripts on your site all matter. If in doubt, ask a lawyer.

What to check before you choose

1. Consent impact. Does the tool work without cookies, browser storage or identifiers that last across days, and can it be set up to meet exemption conditions such as the CNIL’s?
2. Where the data lives. Self-hosted or the developers’ cloud, the hosting region, and whether the provider reuses your data for its own purposes.
3. Complete data. Are reports based on every event, or sampled or modelled?
4. Retention. How long raw data is kept and whether you control it.
5. The cost of self-hosting. The databases the tool needs, how upgrades work, backups and how it scales with your traffic. A single Go binary on SQLite is a different commitment from a stack with ClickHouse and Kafka.
6. Portability. Raw export, APIs, SQL access and importers from the tool you are leaving.
7. License. Whether the whole repository is under an open source license, or some parts are proprietary or paid. The license column above shows the main license; each app page explains the exceptions.