Recherche avancée

Sur d’autres sites (11599)

• Data Privacy Regulations : Essential Knowledge for Global Business

  6 mars, par Daniel Crough

  If you run a website that collects visitors’ data, you might be violating privacy regulations somewhere in the world. At last count, over 160 countries have privacy laws — and your customers in those countries know about them.

  A recent survey found that 53% of people who answered know about privacy rules in their country and want to follow them. This is up from 46% two years ago. Furthermore, customers increasingly want to buy from businesses they can trust with their data.

  That’s why businesses must take data privacy seriously. In this article, we’ll first examine data privacy rules, why we need them, and how they are enforced worldwide. Finally, we’ll explore strategies to ensure compliance and tools that can help.

  What are data privacy regulations ?

  Let’s first consider data privacy. What is it ? The short answer is individuals’ ability to control their personal information. That’s why we need laws and rules to let people decide how their data is collected, used, and shared. Crucially, the laws empower individuals to withdraw permission to use their data anytime.

  The UNCTAD reports that only 13 countries had data protection laws or rules before the 2000s. Many existed before businesses could offer online services, so they needed updating. Today, 162 national laws protect data privacy, half of which emerged in the last decade.

  Why is this regulation necessary ?

  There are many reasons, but the impetus comes from consumers who want their governments to protect their data from exploitation. They understand that participating in the digital economy means sharing personal information like email addresses and telephone numbers, but they want to minimise the risks of doing so.

  Data privacy regulation is essential for :

  • Protecting personal information from exploitation with transparent rules and guidelines on handling it securely.
  • Implementing adequate security measures to prevent data breaches.
  • Enforcing accountability for how data is collected, stored and processed.
  • Giving consumers control over their data.
  • Controlling the flow of data across international borders in a way that fully complies with the regulations.
  • Penalising companies that violate privacy laws.

  Isn’t it just needless red tape ?

  Data breaches in recent years have been one of the biggest instigators of the increase in data privacy regulations. A list of the top ten data breaches illustrates the point.

  #	Company	Location	Year	# of Records	Data Type
  1	Yahoo	Global	2013	3B	user account information
  2	Aadhaar	India	2018	1.1B	citizens’ ID/biometric data
  2	Alibaba	China	2019	1.1B	users’ personal data
  4	LinkedIn	Global	2021	700M	users’ personal data
  5	Sina Weibo	China	2020	538M	users’ personal data
  6	Facebook	Global	2019	533M	users’ personal data
  7	Marriott Int’l	Global	2018	500M	customers’ personal data
  8	Yahoo	Global	2014	500M	user account information
  9	Adult Friend Finder	Global	2016	412.2M	user account information
  10	MySpace	USA	2013	360M	user account information

  And that’s just the tip of the iceberg. Between November 2005 and November 2015, the US-based Identity Theft Resource Center counted 5,754 data breaches that exposed 856,548,312 records, mainly in that country.

  It’s no wonder that citizens worldwide want organisations they share their personal data with to protect that data as if it were their own. More specifically, they want their governments to :

  • Protect their consumer rights
  • Prevent identity theft and other consumer fraud
  • Build trust between consumers and businesses
  • Improve cybersecurity measures
  • Promote ethical business practices
  • Uphold international standards

  Organisations using personal data in their operations want to minimise financial and reputational risk. That’s common sense, especially when external attacks cause 68% of data breaches.

  The terminology of data privacy

  With 162 national laws already in place, the legal space surrounding data privacy grows more complex every day. Michalsons has a list of different privacy laws and regulations in force in significant markets around the world.

  Fortunately, there’s plenty of commonality for two reasons : first, all countries want to solve the same problem ; second, those drafting the legislation have adopted much of what other countries have already developed. As a result, the terminology remains almost the same, even when the language changes.

  These are the core concepts at play :

  Term	Definition
  Access and control	Consumers can access, review, edit and delete their data
  Data protection	Organisations must protect data from being stolen or compromised
  Consumer consent	Consumers can grant and withdraw or refuse access to their data
  Deletion	Consumers can request to have their data erased
  Data breach	When the security of data has been compromised
  Data governance	The management of data within an organisation
  Double opt-in	Two-factor authentication to add a layer of confirmation
  GDPR	Governing data privacy in Europe since 2016
  Personally identifiable information (PII)	Data used to identify, locate, or contact an individual
  Pseudonymisation	Replace personal identifiers with artificial identifiers or pseudonyms
  Publicly available information	Data from official sources, without restrictions on access or use
  Rectification	Consumers can request to have errors in their data corrected

  Overview of current data privacy legislation

  Over three-quarters of the world has formulated and rolled out data privacy legislation — or is currently doing so. Here’s a breakdown of the laws and regulations you can expect to find in most significant markets worldwide.

  Europe

  Thoughts of protecting data privacy first occurred in Europe when the German government became concerned about automated data processing in 1970. A few years later, Sweden was the first country to enact a law requiring permits for processing personal data, establishing the first data protection authority.

  General Data Protection Regulation (GDPR)

  Sweden’s efforts triggered a succession of European laws and regulations that culminated in the European Union (EU) GDPR, enacted in 2016 and enforced from 25 May 2018. It’s a detailed and comprehensive privacy law that safeguards the personal data and privacy of EU citizens.

  The main objectives of GDPR are :

  • Strengthening the privacy rights of individuals by empowering them to control their data.
  • Establishing a uniform data framework for data privacy across the EU.
  • Improving transparency and accountability by mandating businesses to handle personal data responsibly and fully disclose how they use it.
  • Extending the regulation’s reach to organisations external to the EU that collect, store and process the data of EU residents.
  • Requiring organisations to conduct Protection Impact Assessments (PIAs) for “high-risk” projects.

  ePrivacy Regulation on Privacy and Electronic Communications (PECR)

  The second pillar of the EU’s strategy to regulate the personal data of its citizens is the ePrivacy Regulation on Privacy and Electronic Communications (EU PECR). Together with the GDPR, it will comprise data protection law in the union. This regulation applies to :

  • Providers of messaging services like WhatsApp, Facebook and Skype
  • Website owners
  • Owners of apps that have electronic communication components
  • Commercial direct marketers
  • Political parties sending promotional messages electronically
  • Telecommunications companies
  • ISPs and WiFi connection providers

  The EU PECR was intended to commence with GDPR on 25 May 2018. That didn’t happen, and as of January 2025, it was in the process of being redrafted.

  EU Data Act

  One class of data isn’t covered by GDPR or PECR : internet product-generated data. The EU Data Act provides the regulatory framework to govern this data, and it applies to manufacturers, suppliers, and users of IoT devices or related services.

  The intention is to facilitate data sharing, use, and reuse and to facilitate organisations’ switching to a different cloud service provider. The EU Data Act entered into force on 11 January 2024 and is applicable from September 2025.

  GDPR UK

  Before Brexit, the EU GDPR was in force in the UK. After Brexit in 2020, the UK opted to retain the regulations as UK GDPR but asserted independence to keep the framework under review. It’s part of a wider package of reform to the data protection environment that includes the Data Protection Act 2018 and the UK PECR.

  In the USA

  The primary federal law regarding data privacy in the US is the Privacy Act of 1974, which has been in revision for some time. However, rather than wait for the outcome of that process, many business sectors and states have implemented their own measures.

  Sector-specific data protection laws

  This sectoral approach to data protection relies on a combination of legislation, regulation and self-regulation rather than governmental control. Since the mid-1990s, the country has allowed the private sector to lead on data protection, resulting in ad hoc legislation arising when circumstances require it. Examples include the Video Privacy Protection Act of 1988, the Cable Television Protection and Competition Act of 1992 and the Fair Credit Reporting Act.

  

  California Consumer Privacy Act (CCPA)

  California was the first state to act when federal privacy law development stalled. In 2018, it enacted the California Consumer Privacy Act (CCPA) to protect and enforce Californians’ rights regarding the privacy of their personal information. It came into force in 2020.

  California Privacy Act (CPRA)

  In November of that same year, California voters approved the California Privacy Rights Act (CPRA). Billed as the strongest consumer privacy law ever enacted in the US, CPRA works with CCPA and adds the best elements of laws and regulations in other jurisdictions (Europe, Japan, Israel, New Zealand, Canada, etc.) into California’s personal data protection regime.

  Virginia Consumer Data Protection Act (CDPA)

  In March 2021, Virginia became the next US state to implement privacy legislation. The Virginia Consumer Data Protection Act (VCDPA), which is also informed by global legislative developments, tries to strike a balance between consumer privacy protections and business interests. It governs how businesses collect, use, and share consumer data.

  Colorado Privacy Act (CPA)

  Developed around the same time as VCDPA, the Colorado Privacy Act (CPA) was informed by that law and GDPR and CCPA. Signed into law in July 2021, the CPA gives Colorado residents more control over their data and establishes guidelines for businesses on handling the data.

  Other states generally

  Soon after, additional states followed suit and, similar to Colorado, examined existing legislation to inform the development of their own data privacy laws and regulations. At the time of writing, the states with data privacy laws at various stages of development were Connecticut, Florida, Indiana, Iowa, Montana, New York, Oregon, Tennessee, Texas, and Utah.

  By the time you read this article, more states may be doing it, and the efforts of some may have led to laws and regulations coming into force. If you’re already doing business or planning to do business in the US, you should do your own research on the home states of your customers.

  Globally

  Beyond Europe and the US, other countries are also implementing privacy regulations. Some were well ahead of the trend. For example, Chile’s Law on the Protection of Private Life was put on the books in 1999, while Mauritius enacted its first Data Protection Act in 2004 — a second one came along in 2017 to replace it.

  Canada

  The regulatory landscape around data privacy in Canada is as complicated as it is in the US. At a federal government level, there are two laws : The Privacy Act for public sector institutions and the Personal Information Protection and Electronic Documents Act (PIPEDA) for the private sector.

  PIPEDA is the one to consider here. Like all other data privacy policies, it provides a framework for organisations handling consumers’ personal data in Canada. Although not quite up to GDPR standard, there are moves afoot to close that gap.

  The Digital Charter Implementation Act, 2022 (aka Bill C-27) is proposed legislation introduced by federal agencies in June 2022. It’s intended to align Canada’s privacy framework with global standards, such as GDPR, and address emerging digital economy challenges. It may or may not have been finalised when you read this.

  At the provincial level, three of Canada’s provinces—Alberta, British Columbia, and Quebec—have introduced laws and regulations of their own. Their rationale was similar to that of Bill C-27, so they may become redundant if and when that bill passes.

  Japan

  Until recently, Japan’s Act on the Protection of Personal Information (APPI) was considered by many to be the most comprehensive data protection law in Asia. Initially introduced in 2003, it was significantly amended in 2020 to align with global privacy standards, such as GDPR.

  APPI sets out unambiguous rules for how businesses and organisations collect, use, and protect personal information. It also sets conditions for transferring the personal information of Japanese residents outside of Japan.

  

  China

  The new, at least for now, most comprehensive data privacy law in Asia is China’s Personal Information Protection Law (PIPL). It’s part of the country’s rapidly evolving data governance framework, alongside the Cybersecurity Law and the Data Security Law.

  PIPL came into effect in November 2021 and was informed by GDPR and Japan’s APPI, among others. The data protection regime establishes a framework for protecting personal information and imposes significant compliance obligations on businesses operating in China or targeting consumers in that country.

  Other countries

  Many other nations have already brought in legislation and regulations or are in the process of developing them. As mentioned earlier, there are 162 of them at this point, and they include :

  Argentina	Costa Rica	Paraguay
  Australia	Ecuador	Peru
  Bahrain	Hong Kong	Saudi Arabia
  Bermuda	Israel	Singapore
  Brazil	Mauritius	South Africa
  Chile	Mexico	UAE
  Colombia	New Zealand	Uruguay

  Observant readers might have noticed that only two countries in Africa are on that list. More than half of the 55 countries on the continent have or are working on data privacy legislation.

  It’s a complex landscape

  Building a globalised business model has become very complicated, with so much legislation already in play and more coming. What you must do depends on the countries you plan to operate in or target. And that’s before you consider the agreements groups of countries have entered into to ease the flow of personal data between them.

  In this regard, the EU-US relationship is instructive. When GDPR came into force in 2016, so did the EU-US Privacy Shield. However, about four years later, the Court of Justice of the European Union (CJEU) invalidated it. The court ruled that the Privacy Shield didn’t adequately protect personal data transferred from the EU to the US.

  The ruling was based on US laws that allow excessive government surveillance of personal data transferred to the US. The CJEU found that this conflicted with the basic rights of EU citizens under the European Union’s Charter of Fundamental Rights.

  A replacement was negotiated in a new mechanism : the EU-US Data Privacy Framework. However, legal challenges are expected, and its long-term viability is uncertain. The APEC Privacy Framework and the OECD Privacy Framework, both involving the US, also exist.

  

  Penalties for non-compliance

  Whichever way you look at it, consumer data privacy laws and regulations make sense. But what’s really interesting is that many of them have real teeth to punish offenders. GDPR is a great example. It was largely an EU concern until January 2022 when the French data protection regulator hit Google and Facebook with serious fines and criminal penalties.

  Google was fined €150M, and Facebook was told to pay €60M for failing to allow French users to reject cookie tracking technology easily. That started a tsunami of ever-larger fines.

  The largest so far was the €1.2B fine levied by the Irish Data Protection Commission on Meta, the owner of Instagram, Facebook, and WhatsApp. It was issued for transferring European users’ personal data to the US without adequate data protection mechanisms. This significant penalty demonstrated the serious financial implications of non-compliance.

  These penalties follow a structured approach rather than arbitrary determinations. The GDPR defines an unambiguous framework for fines. They can be up to 4% of a company’s total global turnover in the previous fiscal year. That’s a serious business threat.

  What should you do ?

  For businesses committed to long-term success, accepting and adapting to regulatory requirements is essential. Data privacy regulations and protection impact assessments are here to stay, with many national governments implementing similar frameworks.

  However, there is some good news. As you’ve seen, many of these laws and regulations were informed by GDPR or retrospectively aligned. That’s a good place to start. Choose tools to handle your customer’s data that are natively GDPR-compliant.

  For example, web analytics is all about data, and a lot of that data is personal. And if, like many people, you use Google Analytics 4, you’re already in trouble because it’s not GDPR-compliant by default. And achieving compliance requires significant additional configuration.

  A better option would be to choose a web analytics platform that is compliant with GDPR right off the bat. Something like Matomo would do the trick. Then, complying with any of the tweaks individual countries have made to the basic GDPR framework will be a lot easier—and may even be handled for you.

  Privacy-centric data strategies

  Effective website data analysis is essential for business success. It enables organisations to understand customer needs and improve service delivery.

  But that data doesn’t necessarily need to be tied to their identity — and that’s at the root of many of these regulations.

  It’s not to stop companies from collecting data but to encourage and enforce responsible and ethical handling of that data. Without an official privacy policy or ethical data collection practices, the temptation for some to use and abuse that data for financial gain seems too great to resist.

  

  Cookie usage and compliance

  There was a time when cookies were the only way to collect reliable information about your customers and prospects. But under GDPR, and in many countries that based or aligned their laws with GDPR, businesses have to give users an easy way to opt out of all tracking, particularly tracking cookies.

  So, how do you collect the information you need without cookies ? Easy. You use a web analytics platform that doesn’t depend wholly on cookies. For example, in certain countries and when configured for maximum privacy, Matomo allows for cookieless operation. It can also help you manage the cookie consent requirements of various data privacy regulations.

  Choose the right tools

  Data privacy regulations have become a permanent feature of the global business landscape. As digital commerce continues to expand, these regulatory frameworks will only become more established. Fortunately, there is a practical approach forward.

  As mentioned several times, GDPR is considered by many countries to be a particularly good example of effective data privacy regulation. For that reason, many of them model their own legislation on the EU’s effort, making a few tweaks here and there to satisfy local requirements or anomalies.

  As a result, if you comply with GDPR, the chances are that you’ll also comply with many of the other data privacy regulations discussed here. That also means that you can select tools for your data harvesting and analytics that comply with the GDPR out of the box, so to speak. Tools like Matomo.

  Matomo lets website visitors retain full control over their data.

  Before deciding whether to go with Matomo On-premise or the EU-hosted cloud version, why not start your 21-day free trial ? No credit card required.

• Why Matomo is the top Google Analytics alternative

  17 juin, par Joe

  You probably made the switch to Google Analytics 4 (GA4) when Google stopped collecting Universal Analytics (UA) data in July 2023. Up to that point, UA had long been the default analytics platform, despite its many limitations. 

  This was mostly because everyone loved its free nature and simple setup. A Google account was all you needed — even a free legacy G-Suite account worked perfectly. Looking at the analytics for just about any website was easy.

  That all changed with GA4, which addressed many of UA’s shortcomings by introducing a completely new way to model website data. Unfortunately, this also meant you couldn’t transfer historical data from UA into GA4, leading to more criticism. 

  Then there’s the added cost. GA4 is still free, but its limited functionality encourages you to upgrade to the enterprise version, Google Analytics 360 (GA360). Sure, you get lots of great functionality, less data sampling, and longer data retention periods, but it comes at a hefty price — $50,000 per year, to be exact.

  There are other options, though, and Matomo Analytics is one of the best. It’s an open-source, privacy-centric platform that offers advanced features of GA360 and more. 

  In this article, we’ll compare GA4, GA360, and Matomo and give you what you need to make an informed decision.

  Google Analytics 4 in a nutshell

  Google Analytics 4 is a great tool to use to start learning about web analytics. But soon enough, you’ll likely find that GA4 doesn’t quite cover all of your needs. 

  For example, it can’t provide a detailed view of user experiences, and Google doesn’t offer dedicated support or onboarding. There are other shortcomings, too.

  Data sampling

  Google only processes a selected sample of website activity rather than every individual data point. Rather than looking at the whole picture, it sets a threshold and selects a [hopefully] representative sample for analysis. 

  This inevitably creates gaps in data. Google attempts to fill them in using AI and machine learning, inferring the rest from data patterns. Since the results rely on assumptions and estimates, they aren’t always precise.

  In practical terms, this means that the accuracy of GA4 analysis will likely decline as website traffic increases.

  

  (Image source)

  Data collection limits

  GA4’s 25 million monthly events limit seems like a lot, but they add up quickly. 

  All user interactions are recorded as events, including :

  • Session start : User visits the site.
  • Page view : User loads a page (tracked automatically).
  • First visit : User accesses the site for the first time.
  • User engagement : User stays on a page for a set time period.
  • Scroll : User scrolls past 90% of the page (enhanced measurement).
  • Click : User clicks on any element (links, buttons, etc.).
  • Video start/complete : User starts or completes a video (enhanced measurement).
  • File download : User downloads a file (enhanced measurement).

  For context, consider a website averaging 50 events per session per user. If every user logs on every third day, on average, you’ll need 10,000 individual visitors a month to reach that 25 million. But that’s not the problem. 

  The problem is that collection limits in GA4 affect your ability to capture, secure, and analyse customer data effectively.

  Customisation

  GA4 users also face configuration limits that restrict their customisation options. For example : 

  • Audience limits : Since only 100 audiences are allowed, it’s necessary to combine or optimise segments rather than track too many small groups. 
  • Retention limits : Data retention is limited to only 14 months, so external storage solutions may be necessary in situations where historical data needs to be preserved.
  • Conversion events : GA4 will only track up to 30 conversion events, so it’s best to focus on high-value interactions (e.g., purchases and lead form submissions). 
  • Event-scoped dimensions : Since e-commerce operations are limited to 50 event-scoped dimensions, they need to carefully consider custom dimensions and key metrics. This makes it important to be selective about which product details to track (color, size, discount code, etc.).

  Data privacy

  GA4 isn’t GDPR-compliant out of the box. In fact, Google Analytics 4 is banned in seven EU countries because they believe the way it collects and transfers data violates GDPR.

  Data privacy regulations may or may not be a big concern, depending on where your customers are. However, if some are in the UK or any of the 30 countries that make up the European Economic Area (EEA), you must comply with the General Data Protection Regulation (GDPR). 

  It tells your customers that you don’t respect their data if you don’t. It can also get very expensive.

  Limited attribution models

  Attribution models track how different marketing touchpoints lead to a conversion (such as a purchase, sign-up, or lead generation). They help businesses understand which marketing channels and strategies are most effective in driving results.

  GA4 supports only two of the six standard attribution models previously supported in Universal Analytics. Organisations wanting data-driven or last-click attribution models will find them in Google Analytics. But they’ll need to look elsewhere if they’re going to use any of these models :

  • First click attribution
  • Linear attribution
  • Time decay attribution
  • Position-based attribution (u-shaped)

  GA360 isn’t a solution either

  Fundamentally, GA360 is the same product as GA4, without the above limits and restrictions. For companies that pay $50,000 (or more) each year, the only changes involve how much data is collected, how long it stays and data sampling thresholds.

  Above all, the GDPR-compliance issue remains. That can be a real problem for organisations with operations that collect personal data in the EEA or the UK.

  And the problem could soon be much bigger than just those 31 countries. Many countries currently implementing data privacy laws are modelling their efforts on GDPR, which may rule out both GA4 and GA360.

  

  What makes Matomo the top alternative ?

  No data limits

  One way to overcome all these challenges is to switch to Matomo Analytics. 

  There’s no data sampling and no data collection limits whatsoever with on-premise implementation. Matomo also supports all six attribution models, is open source and fully customisable and complies with GDPR out of the box. 

  Imagine trying to change your business strategy or marketing campaigns if you’re not confident that your data is reliable and accurate.

  It’s no secret that data sampling can negatively affect the accuracy of the data, and inaccurate data can lead to poor decision-making.
  

  With Matomo, there are no limits. We don’t restrict the size of containers within the Tag Manager nor the number of containers or tags within each container. You have more control over your customers’ data. 

  And you get to make your decisions based on all that data. That’s important because data quality is critical for high-impact decisions. 

  Open source

  Open-source software allows anyone to inspect, audit, and improve the source code for security and efficiency. That means no hidden data collection, faster bug fixes, and no vendor lock-in. As a bonus, these things make complying with data privacy laws and regulations easier.

  Matomo can also be modified in any way, which provides unlimited customisation possibilities. There’s also a very active developer community around Matomo, so you don’t have to make changes yourself — you can hire someone who has the technical knowledge and expertise. They can : 

  • Modify tracking scripts for advanced analytics
  • Create custom attribution models, tracking methods and dashboards
  • Integrate Matomo with any system (CRM, eCommerce, CMS, etc.)

  Data ownership

  Matomo’s open-source nature also means full data ownership. No third parties can access the data, and there’s no risk of Google using that data for ads or AI training. Furthermore, Matomo follows privacy-first tracking principles, meaning that there’s :

  • No third-party data sharing
  • Full user consent control
  • Support for cookie-less tracking
  • IP Anonymisation, by default
  • Do Not Track (DNT) support

  All of that underlines the fact that Matomo collects, stores, and tracks data 100% ethically.

  On-premise and cloud-based options

  You can use the Matomo On-Premise web analytics solution if local data privacy laws require that you store data locally. Here’s a helpful tip : many of them do. However, this might not be necessary. 

  Due to GDPR, several countries recognise the EEA as an acceptable storage location for their citizens’ data. That means servers hosted in any of those 30 countries are already compliant in terms of data location. 

  Alternatively, you could embrace modernity and choose Matomo Cloud — our servers are also in Europe. While GA4 and GA360 are cloud-based, Google’s servers are in the US, and that’s a big problem for GDPR.

  

  Comprehensive analytics

  If you need a sophisticated web analytics platform that offers full control of your data and you have privacy concerns, Matomo is a solid choice. 

  It has built-in behavioural analytics features like Heatmaps, Scroll Depth and Session Recording. These tools allow you to collect and analyse data without relying on cookies or resorting to data sampling.

  Those standout features can’t be found in GA4 or GA360. Google also doesn’t offer an on-premise solution.

  The one area where Matomo can’t compete with Google Analytics is in its tight integration with the Google ecosystem : Google Ads, Gemini and Firebase. 

  Key things to consider before switching to Matomo

  There are pros and cons to switching from GA4 (or even GA360) to Matomo. That’s because no software is perfect. There are always tradeoffs somewhere. With Matomo, there are a few things to consider before switching :

  • Learning curve. Matomo is a full-featured analytics platform with many advanced features (session replay, custom event tracking, etc.). That can overwhelm new users and take time to understand well enough to maximise the benefits.
  • Technical resources. Choosing a Matomo On-Premise solution requires technical resources, such as a server and skills.
  • Third-party integration. Matomo provides pre-built integration tools for about a hundred platforms. However, it’s open source, so technical resources are required. On the plus side, it does make it possible to add to the list of APIs and connectors.

  Head-to-head : GA4 vs GA360 vs Matomo

  It’s always helpful to look at how different products stack up in terms of features and capabilities :

  	GA4	GA360	Matomo
  Data ownership			✔
  Event-based data	✔	✔	✔
  Session-based data			✔
  Unsampled data			✔
  Real-time data	✔	✔	✔
  Heatmaps			✔
  Session recordings			✔
  A/B testing			✔
  Open source			✔
  On-premise hosting			✔
  Data privacy	Subject to Google’s data policies	Subject to Google’s data policies	GDPR, CCPA compliant ; full control over data storage
  Custom dimensions	Yes (limited in free version)	Yes (higher limits)	Yes (unlimited in self-hosted)
  Attribution models	Last click, data-driven	Last click, data-driven, advanced Google Ads integration	Last click, first click, linear, time decay, position-based, custom
  Data retention	Up to 14 months (free)	Up to 50 months	Unlimited (self-hosted)
  Integrations	Google Ads, Search Console, BigQuery (limited in free version)	Advanced integrations (Google Ads, BigQuery, Salesforce, etc.)	100+ integrations (Google Ads, WordPress, Shopify, etc.)
  BigQuery export	Free (limited to 1M events/day)	Free (unlimited)	Paid add-on (via plugin)
  Custom reports	Limited customisation	Advanced customisation	Fully customisable
  Scalability	Suitable for small to medium businesses	Designed for large enterprises	Scalable without limits (self-hosted or cloud)
  Ease of use	Simple, requires onboarding	Steeper learning curve	Flexible, setup-intensive.
  Pricing	Free	Premium (starts at $50,000/year)	Free open-source (self-hosted) ; Cloud starts at $29/month

  So, is Matomo the right solution for you ?

  That’d be a ‘yes’ if you want a Google Analytics alternative that ticks all these boxes :

  • Complies natively with privacy laws and regulations
  • Offers real-time data and custom event tracking
  • Enables a deeper understanding of user behaviour
  • Allows you to fine-tune user experiences
  • Provides full control over your customers’ data
  • Offers conversion funnels, session recordings and heatmaps
  • Has session replay to trace user interactions
  • Includes plenty of readily actionable insights

  Find out why millions of websites trust Matomo

  Matomo is an easy-to-use, all-in-one web analytics tool with advanced behavioural analytics functionality.

  It’ll also help you future-proof your business because it supports compliance with global privacy laws in 162 countries. With an ethical alternative like Matomo, you don’t need to risk your business or customers’ private data.

  It’s not just about avoiding fines. It’s also about building trust with your customers. That’s why you need a privacy-focused, ethical solution like Matomo. 

  See for yourself : download Matomo On-Premise today, or start your 21-day free trial of Matomo Cloud (no credit card required).

• Choosing the best self-hosted open-source analytics platform

  16 juillet, par Joe

  Google Analytics (GA) is the most widely used analytics platform, with 50.3% of the top 1 million active websites using it today. You’re probably using it right now. 

  But despite being a free tool, Google Analytics is proprietary software, which means you’re handing over your browsing data, metadata and search history to a third party.

  Do you trust them ? We sure don’t.

  This lack of control can lead to potential privacy risks and compliance issues. These issues have so far resulted in fines under the EU’s General Data Protection Regulation (GDPR) of an average of €2.5 million each, for a total of almost €6.6 billion since 2018.

  Open-source analytics platforms offer a solution. They’re a safer and more transparent alternative that lets you retain full control over how you collect and store your customers’ data. But what are these tools ? Where do you find them ? And, most importantly, how do you choose the best one for your needs ?

  This guide explores the benefits and features of open-source analytics platforms and compares popular options, including Matomo, a leading self-hosted, open-source Google Analytics alternative.

  What is an open-source analytics platform ?

  An analytics platform is software that collects, processes and analyses data to gain insights, identify trends, and make informed decisions. It helps users understand past performance, monitor current activities and predict future outcomes.

  An open-source analytics platform is a type of analytics suite in which anyone can view, modify and distribute the underlying source code.

  In contrast to proprietary analytics platforms, where a single entity owns and controls the code, open-source analytics platforms adhere to the principles of free and open-source software (FOSS). This allows everyone to use, study, share, and customise the software to meet their needs, fostering collaboration and transparency.

  Open-source analytics and the Free Software Foundation

  The concept of FOSS is rooted in the idea of software freedom. According to the Free Software Foundation (FSF), this idea is defined by four fundamental freedoms granted to the user the freedom to :

  • Use or run the program as they wish, for any purpose.
  • Study how the program works and change it as they wish.
  • Redistribute copies to help others.
  • Improve the code and distribute copies of their improved versions to others.

  Open access to the source code is a precondition for guaranteeing these freedoms.

  The importance of FOSS licensing

  The FSF has been instrumental in the free software movement, which serves as the foundation for open-source analytics platforms. Among other things, it created the GNU General Public Licence (GPL), which guarantees that all software distributions include the source code and are distributed under the same licence.

  However, other licences, including several copyleft and permissive licences, have been developed to address certain legal issues and loopholes in the GPL. Analytics platforms distributed under any of these licences are considered open-source since they are FSF-compliant.

  Benefits and drawbacks of open-source analytics platforms

  Open-source analytics platforms offer a compelling alternative to their proprietary counterparts, but they also have a few challenges.

  

  Benefits of open-source analytics

  • Full data ownership : Many open-source solutions let you host the analytics platform yourself. This gives you complete control over your customers’ data, ensuring privacy and security.
  • Customisable solution : With access to the source code, you can tailor the platform to your specific needs.
  • Full transparency : You can inspect the code to see exactly how data is collected, processed and stored, helping you ensure compliance with privacy regulations.
  • Community-driven development : Open-source projects benefit from the contributions of a global community of developers. This leads to faster innovation, quicker bug fixes and, in some cases, a wider range of features.
  • No predefined limits : Self-hosted open-source analytics platforms don’t impose arbitrary limits on data storage or processing. You’re only limited by your own server resources.

  Cons of open-source analytics

  • Technical expertise required : Setting up and maintaining a self-hosted open-source platform often requires technical knowledge.
  • No live/dedicated support team : While many projects have active communities, dedicated support might be limited compared to commercial offerings.
  • Integration challenges : Integrating with other tools in your stack might require custom development, especially if pre-built integrations aren’t available.
  • Feature gaps : Depending on the specific platform, there might be gaps in functionality compared to mature proprietary solutions.

  Why open-source is better than proprietary analytics

  Proprietary analytics platforms, like Google Analytics, have long been the go-to choice for many businesses. However, growing concerns around data privacy, vendor lock-in and limited customisation are driving a shift towards open-source alternatives.

  No vendor lock-in

  Proprietary platforms lock you into their ecosystem, controlling terms, pricing and future development. Migrating data can be costly, and you’re dependent on the vendor for updates. 

  Open-source platforms allow users to switch providers, modify software and contribute to development. Contributors can also create dedicated migration tools to import data from GA and other proprietary platforms.

  Data privacy concerns

  Proprietary analytics platforms can heighten the risk of data privacy violations and subsequent fines under regulations like the GDPR and the California Consumer Privacy Act (CCPA). This is because their opaque ‘black box’ design often obscures how they collect, process and use data. 

  Businesses often have limited visibility and even less control over a vendor’s data handling. They don’t know whether these vendors are using it for their own benefit or sharing it more widely, which can lead to privacy breaches and other data protection violations.

  These fines can reach into the millions and even billions. For example, Zoom was fined $85 million in 2021 for CCPA violations, while the largest fine in history has been the €1.2 billion fine imposed on Meta by the Irish Data Protection Act (DPA) under the EU GDPR.

  Customisation

  Proprietary platforms often offer a one-size-fits-all approach. While they might have some customisation options, you’re ultimately limited by what the vendor provides. Open-source platforms, on the other hand, offer unparalleled flexibility.

  Unlimited data processing

  Proprietary analytics platforms often restrict the amount of data you can collect and process, especially on free plans. Going over these limits usually requires upgrading to a paid plan, which can be a problem for high-traffic websites or businesses with large datasets. 

  Self-hosted tools only limit data processing based on your server resources, allowing you to collect and analyse as much data as you need at no extra cost.

  No black box effect

  Since proprietary tools are closed-source, they often lack transparency in their data processing methods. It’s difficult to understand and validate how their algorithms work or how they calculate specific metrics. This “black box” effect can lead to trust issues and make it challenging to validate your data’s accuracy.

  11 Key features to look for in an open-source analytics platform

  Choosing the right open-source analytics platform is crucial for unlocking actionable insights from your customers’ data. Here are 11 key features to consider :

  

  #1. Extensive support documentation and resource libraries

  Even with technical expertise, you might encounter challenges or have questions about the platform. A strong support system is essential. Look for platforms with comprehensive documentation, active community forums and the option for professional support for mission-critical deployments.

  #2. Live analytics

  Having access to live data and reports is crucial for making timely and informed decisions. A live analytics feature allows you to :

  • Monitor website traffic as it happens.
  • Optimise campaign performance tracking.
  • Identify and respond to issues like traffic spikes, drops or errors quickly, allowing for rapid troubleshooting.

  For example, Matomo updates tracking data every 10 seconds, which is more than enough to give you a live view of your website performance.

  #3. Personal data tracking

  Understanding user behaviour is at the heart of effective analytics. Look for a platform that allows you to track personal data while respecting privacy. This might include features like :

  • Creating detailed profiles of individual users and tracking their interactions across multiple sessions.
  • Track user-specific attributes like demographics, interests or purchase history.
  • Track user ID across different devices and platforms to understand user experience.

  #4. Conversion tracking

  Ultimately, you want to measure how effective your website is in achieving your business goals. Conversion tracking allows you to :

  • Define and track key performance indicators (KPIs) like purchases, sign-ups or downloads.
  • Identify bottlenecks in the user journey that prevent conversions.
  • Measure the ROI of your marketing campaigns.

  #5. Session recordings

  Session recordings give your development team a qualitative understanding of user behaviour by letting you watch replays of individual user sessions. This can help you :

  • Identify usability issues.
  • Understand how users navigate your site and interact with different elements.
  • Uncover bugs or errors.

  #6. A/B testing

  Experimentation is key to optimising your website and improving conversion rates. Look for an integrated A/B testing feature that allows you to :

  • Test different variations of your website in terms of headlines, images, calls to action or page layouts.
  • Measure the impact on key metrics.
  • Implement changes based on statistically significant differences in user behaviour patterns, rather than guesswork.

  #7. Custom reporting and dashboards

  Every business has unique reporting needs. Look for a flexible platform that allows you to :

  • Build custom reports that focus on the metrics that matter most to you.
  • Create personalised dashboards that provide a quick overview of those KPIs.
  • Automate report generation to save your team valuable time.

  #8. No data sampling

  Data sampling can save time and processing power, but it can also lead to inaccurate insights if the sample isn’t representative of the entire dataset. The solution is to avoid data sampling entirely.

  Processing 100% of your customers’ data ensures that your reports are accurate and unbiased, providing a true picture of customer behaviour.

  #9. Google Analytics migration tools

  If you’re migrating from Google Analytics, a data export/import tool can save you time and effort. Some open-source analytics projects offer dedicated data importers to transfer historical data from GA into the new platform, preserving valuable insights. These tools help maintain data continuity and simplify the transition, reducing the manual effort involved in setting up a new analytics platform.

  #10 A broad customer base

  The breadth and diversity of an analytics platform’s customer base can be a strong indicator of its trustworthiness and capabilities. Consider the following :

  • Verticals served
  • The size of the companies that use it
  • Whether it’s trusted in highly-regulated industries

  If a platform is trusted by a large entity with stringent security and privacy requirements, such as governments or military branches, it speaks volumes about its security and data protection capabilities.

  #11 Self-hosting

  Self-hosting offers unparalleled control over your customers’ data and infrastructure.

  Unlike cloud-based solutions, where your customers’ data resides on third-party servers, self-hosting means you manage your own servers and databases. This approach ensures that your customers’ data remains within your own infrastructure, enhancing privacy and security.

  There are other features, like analytics for mobile apps, but these 11 will help shortlist your options to find the ideal tool.

  Choosing your self-hosted open-source analytics platform : A step-by-step guide

  The right self-hosted open-source analytics platform can significantly impact your data strategy. Follow these steps to make the best choice :

  

  Step #1. Define your needs and objectives

  Begin by clearly outlining what you want to achieve with your analytics platform :

  • Identify relevant KPIs.
  • Determine what type of reports to generate, their frequency and distribution.
  • Consider your privacy and compliance needs, like GDPR and CCPA.

  Step #2. Define your budget

  While self-hosted open-source platforms are usually free to use, there are still costs associated with self-hosting, including :

  • Server hardware and infrastructure.
  • Ongoing maintenance, updates and potential support fees.
  • Development resources if you plan to customise the platform.

  Step #3. Consider scalability and performance

  Scaling your analytics can be an issue with self-hosted platforms since it means scaling your server infrastructure as well. Before choosing a platform, you must think about :

  • Current traffic volume and projected growth.
  • Your current capacity to handle traffic.
  • The platform’s scalability options.

  Step #4. Research and evaluate potential solutions

  Shortlist a few different open-source analytics platforms that align with your requirements. In addition to the features outlined above, also consider factors like :

  • Ease of use.
  • Community and support.
  • Comprehensive documentation.
  • The platform’s security track record.

  Step #5. Sign up for a free trial and conduct thorough testing

  Many platforms offer free trials or demos. Take advantage of these opportunities to test the platform’s features, evaluate the user interface and more.

  You can embed multiple independent tracking codes on your website, which means you can test multiple analytics platforms simultaneously. Doing so helps you compare and validate results based on the same data, making comparisons more objective and reliable.

  Step #6. Plan for implementation and ongoing management

  After choosing a platform, follow the documentation to install and configure the software. Plan how you’ll migrate existing data if you’re switching from another platform.

  Ensure your team is trained on the platform, and establish a plan for updates, security patches and backups. Then, you’ll be ready to migrate to the new platform while minimising downtime.

  Top self-hosted open-source analytics tools

  Let’s examine three prominent self-hosted open-source analytics tools.

  Matomo

  Main Features	Analytics updated every 10 seconds, custom reports, dashboards, user segmentation, goal tracking, e-commerce tracking, funnels, heatmaps, session recordings, A/B testing, SEO tools and more advanced features.
  Best for	Businesses of all sizes and from all verticals. Advanced users
  Licencing	GPLv3 (core platform).Various commercial licences for plugins.
  Pricing	Self-hosted : Free (excluding paid plugins).Cloud version : Starts at $21.67/mo for 50K website hits when paid annually.

  

  Matomo Analytics dashboard

  Matomo is a powerful web analytics platform that prioritises data privacy and user control. It offers a comprehensive suite of features, including live analytics updated every 10 seconds, custom reporting, e-commerce tracking and more. You can choose between a full-featured open-source, self-hosted platform free of charge or a cloud-based, fully managed paid analytics service.

  Matomo also offers 100% data ownership and has a user base of over 1 million websites, including heavyweights like NASA, the European Commission, ahrefs and the United Nations.

  Plausible Analytics

  Main Features	Basic website analytics (page views, visitors, referrers, etc.), custom events, goal tracking and some campaign tracking features.
  Best for	Website owners, bloggers and small businesses.Non-technical users.
  Licencing	AGPLv3.
  Pricing	Self-hosted : FreeCloud version : Starts at $7.50/mo for 10K website hits when paid annually.

  

  Plausible Analytics 
  (Image source)

  Plausible Analytics is a lightweight, privacy-focused analytics tool designed to be simple and easy to use. It provides essential website traffic data without complex configurations or intrusive tracking.

  Fathom Lite & Fathom Analytics

  Main features	Basic website analytics (page views, visitors, referrers, etc.), custom events and goal tracking.
  Best for	Website owners and small businesses.Non-technical users.
  Licencing	Fathom Lite : MIT Licence (self-hosted).Fathom Analytics : Proprietary.
  Pricing	Fathom Lite : Free but currently unsupported.Cloud version : Starts at $12.50/month for up to 50 sites when paid annually.

  

  Fathom Analytics 
  (Image source)

  Fathom started as an open-source platform in 2018. But after the founders released V1.0.1, they switched to a closed-source, paid, proprietary model called Fathom Analytics. Since then, it has always been closed-source.

  However, the open-source version, Fathom Lite, is still available. It has very limited functionality, uses cookies and is currently unsupported by the company. No new features are under development and uptime isn’t guaranteed.

  Matomo vs. Plausible vs. Fathom

  Matomo, Plausible, and Fathom are all open-source, privacy-focused alternatives to Google Analytics. They offer features like no data sampling, data ownership, and EU-based cloud hosting.

  Here’s a head-to-head comparison of the three :

  	Matomo	Plausible	Fathom
  Focus	Comprehensive, feature-rich, customizable	Simple, lightweight, beginner-friendly	Simple, lightweight, privacy-focused
  Target User	Businesses, marketers and analysts seeking depth	Beginners, bloggers, and small businesses	Website owners and users prioritising simplicity
  Open Source	Fully open-source	Fully open-source	Limited open-source version
  Advanced analytics	Extensive	Very limited	Very limited
  Integrations	100+	Limited	Fewer than 15
  Customisation	High	Low	Low
  Data management	Granular control, raw data access, complex queries	Simplified, no raw data access	Simplified, no raw data access
  GDPR features	Compliant by design, plus GDPR Manager	Guides only	Compliant by design
  Pricing	Generally higher	Generally lower	Intermediate
  Learning curve	Steeper	Gentle	Gentle

  The open-core dilemma

  Open-source platforms are beneficial and trustworthy, leading some companies to falsely market themselves as such.

  Some were once open-source but later became commercial, criticised as “bait-and-switch.” Others offer a limited open-source “core” with proprietary features, called the “open core” model. While this dual licensing can be ethical and sustainable, some abuse it by offering a low-value open-source version and hiding valuable features behind a paywall.

  However, other companies have embraced the dual-licensing model in a more ethical way, providing a valuable solution with a wide range of tools under the open-source license and only leaving premium, non-essential add-ons as paid features.

  Matomo is a prime example of this practice, championing the principles of open-source analytics while developing a sustainable business model for its users’ benefit.

  Choose Matomo as your open-source data analytics tool

  Open-source analytics platforms offer compelling advantages over proprietary solutions like Google Analytics. They provide greater transparency, data ownership and customisation. Choosing an open-source analytics platform over a proprietary one gives you more control over your customers’ data and supports compliance with user privacy regulations.

  With its comprehensive features, powerful tools, commitment to privacy and active community, Matomo stands out as a leading choice. Make the switch to Matomo for ethical, user-focused analytics.

  Try Matomo for free.