Umami vs Google Analytics 4: do you still need a cookie banner?

Google Analytics almost always needs a cookie banner. A cookieless tool like Umami usually does not, and it counts the visitors a banner loses. We put Umami on every site we build, so you should know we have a view. Here is the honest comparison, including where Google Analytics is still the better choice.

By Elliot · Published 23 October 2026 · 9 min read

What “cookieless” actually means

Cookieless analytics count visits without leaving anything on the visitor's device. That matters because the law is wider than cookies. The UK rules (the Privacy and Electronic Communications Regulations, as changed by the Data (Use and Access) Act 2025) cover storing information on a device or reading it back, so local storage, tracking pixels and scripts that read device details are all in scope, not just cookies.

Umami counts a visit on its server, not in the browser. It takes the website, the visitor's IP address and browser type, the current month and a secret unique to the installation, and turns them into a one-way code. Page views with the same code are grouped as one visitor. The IP address itself is never saved, and the code changes each month by default, so the same person cannot be followed from one month to the next, or onto another website.

To be precise about it: Umami writes nothing to the device, but its script does read two things, the screen size and a setting that tells it whether the visitor has opted out. That is why Umami relies on the statistics exemption described below rather than sitting outside the rules altogether, and why the opt-out is not optional.

Why Google Analytics usually needs a banner

Since 5 February 2026, UK law has had an exemption from cookie consent for analytics whose only purpose is to produce statistics about how a site is used, so it can be improved. The data must not be shared except to help with those improvements, visitors must be told clearly, and they must have a simple, free way to object. The ICO's guidance adds that it is not a broad exception, that the data should be aggregated, that it does not allow monitoring of individual visitors, and that it never covers advertising.

A standard GA4 set-up sits badly with that. It sets a _ga cookie that Google describes as being “used to distinguish users”, kept for two years by default, and with data sharing switched on Google acts as an independent controller of the data rather than your processor. The ICO does not name any product, and no regulator has said GA4 qualifies. So the safe reading for most sites is the usual one: GA4 needs consent before it loads.

The cost of that banner is missing data. In an ICO survey of 2,316 UK adults in March 2024, 21% said they normally reject cookies and a further 24% said it depends on the website. Google's Consent Mode can model the visits it does not see, but only when a site sends at least 1,000 events a day from people who declined and has at least 1,000 consenting users a day. A local business site never gets near that, so the visitors who say no simply disappear from the reports.

None of this makes Google Analytics illegal. The UK-US data bridge has been in force since October 2023 and Google is certified under it. Used with a consent banner that works, GA4 is a lawful choice. It is just a heavier one than most small sites need.

When Google Analytics is still the right choice

GA4 is the better tool if you build remarketing audiences from site visitors, if your Google Ads smart bidding needs fast on-site signals, if you run a large online shop that lives in merchandising reports, or if your marketing team already knows it inside out. If that is you, we would set GA4 up properly, with a consent banner that blocks it until the visitor agrees, rather than talk you out of it.

And Umami has costs of its own. Self-hosting means a server and a database that someone keeps running and backed up. Visitor numbers are estimates: a visitor who changes network, or returns next month, counts again. Some ad blockers block some Umami set-ups. There are no age, gender or interest reports, no audiences to advertise to, and no way to import your Google Analytics history. For a service business that wants to know which pages bring enquiries, none of that usually matters. For a large advertiser, some of it might.

No banner, no cookies, every visitor counted

Every website we build ships with cookieless Umami analytics, which we host and run for you, and a private link to your own dashboard. This site works the same way: it sets no cookies, stores nothing on your device, and our cookie policy explains exactly what is recorded and has a one-click switch for anyone who would rather not be counted.

We check rather than assume. When we audited every client site that was live in August 2026, each one set zero cookies during normal browsing, and Umami was confirmed cookieless by testing it in a browser rather than taking it on trust. Leaving out a 170 KB analytics tag also helps the thing that matters most for a small business site: how quickly it loads on a phone. Our guide to why website speed matters explains the knock-on effect on enquiries and rankings.

More guides and comparisons