In June 2023, the Swedish data protection authority fined the telecom operator Tele2 12 million kronor. Its offense: using Google Analytics, a simple traffic statistics tool, in conditions judged contrary to the GDPR. The fine was upheld on appeal in October 2025.
That case sums up what is at stake. Choosing a statistics plugin for WordPress means choosing where your visitors’ data goes: to Google, into your own database, or to a European provider. And that choice largely decides what you have to ask visitors before counting their visits.
This comparison covers the ten plugins that matter in 2026, from Google Analytics connectors to tools hosted on your own site, with their strengths, their limits and what they mean for consent in Europe. It does not replace legal advice, but it will help you avoid the most common mistakes.
How we ranked them
The first criterion is the data model: where information is collected and stored, and by whom. The second is the impact on consent in Europe, particularly against the conditions the French data protection authority (CNIL) sets for consent-exempt audience measurement.
Then come the depth of reports, the performance cost (one more script on every page, one more database request), the real price and maintenance: date of the last update, compatibility with WordPress 7.1.
Install counts and prices were read in October 2026 on WordPress.org and on the vendors’ official pages. Several vendors show a discounted first-year price, or a price that varies with the visitor’s country: we flag it.
Three families of analytics plugins
Before comparing tools, you need to tell three architectures apart. They have neither the same costs nor the same legal consequences.
Google Analytics connectors
Site Kit, MonsterInsights and ExactMetrics install the Google Analytics 4 tag and display its reports in the admin. Data is collected and stored by Google. Since Universal Analytics was shut down in July 2023, all these plugins work exclusively with GA4.
Self-hosted tools
Matomo, WP Statistics, Burst Statistics, Independent Analytics and Koko Analytics record visits in your own WordPress database. No data leaves your server: if it is hosted in Europe, the question of transfers outside Europe goes away, but not automatically the question of consent.
Hosted services
Plausible and Jetpack Stats collect data on their own servers; the plugin acts as a connector. Plausible hosts its data in Europe, Jetpack Stats at Automattic.
1. Site Kit by Google: the official connector
What it does
Site Kit, Google’s official plugin, installed on more than 5 million sites, brings the dashboards of Search Console, Google Analytics, AdSense and PageSpeed Insights into WordPress, and sets up Tag Manager without code. It also shows statistics per post.
Strengths
It is free and open source, and Google commits to keeping it that way. It includes Google’s consent mode: once enabled in its settings, and connected to the WP Consent API plugin and a consent management tool, it excludes visitors from the European Economic Area, Switzerland and the United Kingdom from Analytics and Ads tracking until they accept. No cookie is set, but the tag tells Google about the refusal.
Limits
Data goes to Google, and its own FAQ states that notice and consent remain the site owner’s responsibility. Each administrator must connect their own Google account. The IP anonymization setting still mentioned in its documentation dates from Universal Analytics: GA4 does not log IP addresses.
Price and audience
Free. Site Kit suits sites that already use Google’s tools (Search Console, Ads, AdSense) that want their reports without leaving WordPress. Our comparison of WordPress SEO plugins explains what is at stake on the Search Console side.
2. MonsterInsights: Google Analytics for marketers
What it does
MonsterInsights, from Awesome Motive, with more than 2 million installs, sets up GA4 without code and presents its reports in the admin. Its paid versions add ecommerce tracking (WooCommerce, Easy Digital Downloads), form conversions and popular content.
Strengths
It is the most complete connector for a store. Its “EU Compliance” add-on disables some advertising features and integrates with the main consent tools to hold tracking until the visitor agrees.
Limits
Data still goes to Google. The option that hosts the gtag.js script on your server does not change where the data ends up. The vendor itself warns that no plugin can guarantee full legal compliance. Its description claims more users than the installs shown in the directory.
Price and audience
The Plus plan costs $99.50 for the first year, then $199; WooCommerce tracking and the sales report require the Pro plan, $199.50 for the first year, then $399. MonsterInsights suits marketers and WooCommerce stores that want GA4 sales reports inside WordPress.
3. ExactMetrics: MonsterInsights’ twin
What it does
ExactMetrics, with more than 300,000 installs, takes the same approach: GA4 setup, reports in the admin, event and ecommerce tracking. Its pricing page is in fact published by the same company as MonsterInsights.
Strengths and limits
Its features are close to MonsterInsights’, at comparable prices. ExactMetrics is the former Google Analytics Dashboard for WP, acquired and then renamed, and its rating in the directory remains low. For a new site, it brings nothing its twin does not already do.
Price and audience
The Plus plan costs $99.50 for the first year, then $199. ExactMetrics mainly concerns sites that inherited it.
4. Matomo: the full platform, on your own site
What it does
The Matomo plugin, with more than 100,000 installs, runs the entire Matomo analytics platform inside WordPress, with data stored in your database. It offers a level of detail comparable to Google Analytics: ecommerce, tag manager, goals, imports from Google Analytics or WP Statistics.
Strengths
You keep full control of the data, and GDPR tools are built in: opt-out shortcode, export and deletion, retention period. Matomo publishes the configuration needed to stay within the consent exemption in France, and its own self-assessment against the CNIL criteria covers its Cloud and On-Premise editions.
Limits
Matomo itself warns that it can use significant resources: 256 MB of PHP memory is recommended, and every pageview adds a request. The future version 6 will require PHP 8.1 and a recent database. For heavy traffic, the vendor recommends a separate installation or its Cloud offer. The listing was only tested up to WordPress 7.1.0 in October 2026. Finally, by default, the plugin sets cookies and turns on ecommerce tracking: turn them off if you are aiming for the exemption.
Price and audience
The plugin is free; paid add-ons bring heatmaps, session recordings or funnels. Matomo Cloud starts at €29 per month. It suits organizations that want professional-grade analytics without sending their data to a third party, on solid hosting.
5. WP Statistics: the long-standing cookieless counter
What it does
WP Statistics, from VeronaLabs, with more than 600,000 installs, counts visits in your database without setting a cookie. It provides reports by country, author and category, plus email reports.
Strengths
Its handling of IP addresses is documented: the last octet of an IPv4 address is removed, then the whole is hashed with a salt renewed every day. The vendor states it uses no cookies, browser cache or local storage. It integrates with WordPress’s consent API.
Limits
The daily salt makes it impossible to recognize a returning visitor. Its option to bypass ad blockers, which renames the script path, may make privacy-minded readers uneasy.
Price and audience
Free; Premium costs $119 per year for one site. WP Statistics suits content sites that want a free, proven, cookieless counter.
6. Burst Statistics: a clean dashboard, a choice of modes
What it does
Burst Statistics, from the same family as UpdraftPlus, with more than 200,000 installs, stores statistics locally and offers goals, real time, Search Console integration and email reports.
Strengths
Its dashboard is one of the most readable. It offers several tracking modes, including a private mode that renews its hashing salt every day.
Limits
Its own FAQ says so: by default, Burst uses cookies. Cookieless mode must be turned on, and one of the modes relies on a form of browser fingerprinting. The promise of doing without a consent banner is phrased cautiously by the vendor, “in many countries”.
Price and audience
The Creator plan costs $49 per year for one site. Burst suits site owners who want a clear tool and an optional cookieless mode.
7. Independent Analytics: rich statistics with no external service
What it does
Independent Analytics, with more than 100,000 installs, records visits in your database with no cookies or external servers. The free version covers the essentials: pages, referrers, countries and devices.
Strengths
For a site that wants reports close to Google Analytics without leaving WordPress, it is one of the most complete, provided you move to the Pro plan: real-time reports, UTM campaigns, click, WooCommerce sales and form tracking, and visitor journeys are reserved for it.
Limits
Visitors are recognized through a hash of the IP address, the browser and a salt that, by default, never changes. An option renews it every day: turn it on if you are aiming for the CNIL exemption, whose grid recommends a time component. The plugin requires PHP 8.0. And several paid features, such as individual journeys or campaigns, take the tool outside the CNIL self-assessment framework once enabled.
Price and audience
The Pro plan starts at $49 per year. Independent Analytics suits bloggers, agencies and stores that want to do without Google Analytics.
8. Koko Analytics: the lightest option
What it does
Koko Analytics, by Danny van Kooten, with more than 60,000 installs, adds less than one kilobyte to your pages, and its collection endpoint bypasses WordPress so it does not slow the site down. It imports data from Jetpack Stats, Plausible, Burst, WP Statistics and others.
Strengths
It is the most restrained choice, open source, with automatic cleanup of old data. For a site that watches its Core Web Vitals, its impact is minimal.
Limits
By default, Koko sets a cookie that expires at midnight. Cookieless mode, based on a hash with a secret renewed every day, must be chosen in the settings. Reports are deliberately simple.
Price and audience
The Pro plan costs €59 per year for one site. Koko suits sites that want aggregate numbers at the lowest performance cost.
9. Plausible: the European cookieless service
What it does
Plausible is a hosted, cookieless statistics service. The plugin, with more than 10,000 installs, inserts the script, shows the dashboard in WordPress and tracks WooCommerce sales, downloads and outbound links. Revenue tracking, however, requires the Business plan, at $19 per month.
Strengths
Its data policy is public: a visitor identifier is a hash of a salt renewed and deleted every 24 hours, the domain, the IP address and the browser. Neither the IP address nor the browser is stored, and data is processed in Europe, on infrastructure owned by European companies.
Limits
It is a paid service, after a 30-day trial; only the Community Edition, which you install on your own server, is free. As with any processor, a data processing agreement is needed.
Price and audience
The Starter plan costs $9 per month for 10,000 pageviews (the displayed price varies by country). Plausible suits sites that want a hosted, European, maintenance-free tool.
10. Jetpack Stats: WordPress.com’s statistics
What it does
Jetpack Stats exists as a module of Jetpack, installed on more than 3 million sites, and, since September 23, 2026, as a standalone plugin. It shows real-time views, traffic sources, countries, clicks, downloads and WooCommerce trends.
Strengths and limits
No configuration is needed, but the site must be connected to a WordPress.com account, and data is processed by Automattic, which keeps IP address logs for 28 days. Above all, the free plan is reserved for personal sites: a site with ads, sales, affiliate links or business activity must pay for the Commercial plan.
Price and audience
Free for personal sites; the Commercial plan was shown at $8.33 per month, billed yearly, from the United States (first-year price, renewals at full price). Jetpack Stats suits personal blogs and sites already on Jetpack.
The Tele2 case: five years of Google Analytics before regulators
Of a whole wave of European decisions against the use of Google Analytics, Tele2’s story is the one that went furthest in court. It shows who is responsible, what does not protect you, and how much the framework can shift.
The starting point
On July 16, 2020, the Court of Justice of the European Union struck down the “Privacy Shield”, the agreement that governed data transfers to the United States. On August 14, a user logged into their Google account visited the website of Swedish operator Tele2, which ran Google Analytics. Three days later, the association noyb filed 101 model complaints across Europe against sites using Google Analytics or Facebook Connect.
Winter 2022, from Vienna to Paris
On December 22, 2021, the Austrian authority ruled that a health portal’s use of Google Analytics was unlawful: the identifiers set by its cookies are personal data, and Google’s contractual safeguards are not enough against access by US intelligence services.
On February 10, 2022, the CNIL announced a first formal notice; two more followed on March 2. These decisions, published in anonymized form, set three principles: by choosing to embed Google Analytics, the site becomes the data controller; a cookie banner is not explicit consent to a transfer; and a truncated IP address can still help identify a person. The Italian authority followed in June 2022.
Tele2: twelve million kronor and two lost appeals
On June 30, 2023, the Swedish authority issued its decisions against four companies. Tele2 was fined 12 million kronor, the retailer CDON 300,000; two others were only ordered to stop. Tele2 had in fact already stopped using the tool on its own initiative.
Its defense rested in part on IP truncation: replacing the last number with a zero was supposed to make the data anonymous. The authority ruled otherwise, since Google could combine it with other information it holds. The administrative court rejected Tele2’s appeal in October 2024, and the appeal court in October 2025.
Ten days later, a new framework
On July 10, 2023, ten days after the Swedish decision, the European Commission adopted the Data Privacy Framework, a new framework that once again allows transfers to certified US companies. Google has relied on it for Analytics since September 1, 2023. The General Court of the European Union dismissed an action for annulment in September 2025; an appeal is pending, and new requests for review were sent to the Commission in summer 2026.
What it means for a WordPress site
The party responsible for the transfer is the site operator: it is the one that receives the formal notice or the fine. IP truncation convinced none of the authorities that ruled. And the legal basis for the tool can change with a court ruling or a Commission decision, as it did in 2020 (Schrems II) and in 2023 (Data Privacy Framework).
A self-hosted tool on a European server makes the transfer question disappear. It does not settle the consent question, which the CNIL treats separately.
Consent in France: what the CNIL exemption really requires
In France, article 82 of the data protection law (the national version of the ePrivacy Directive) requires consent before reading or storing information on a visitor’s device. The CNIL allows an exemption for audience measurement, under precise conditions.
The conditions
Measurement must serve only to produce anonymous statistics on behalf of the site publisher alone, with no cross-referencing with other processing, no transmission of non-anonymous data to third parties and no tracking across sites. The CNIL recommends trackers that live 13 months at most, and data retention of 25 months at most. Visitors must be informed and able to object.
The end of the list
On July 4, 2025, the CNIL replaced its list of evaluated tools with a self-assessment tool for vendors. No vendor may call itself “certified” or “approved” by the CNIL. Offers where the provider reuses data for its own purposes fall outside the exemption, unless that reuse is switched off.
This grid rules out several features plugins sell: campaign and UTM tracking, individual journeys, third-party integrations. Once enabled, they take the tool outside the self-assessment framework, and so, unless the vendor documents otherwise, outside the exemption.
Cookieless does not mean rule-free
The European Data Protection Board’s guidelines, adopted in October 2024, apply the consent rule to techniques other than cookies, including browser fingerprinting. Yet several “cookieless” modes rely on a hash of the IP address and the browser. The CNIL grid recommends that this hash include a site-specific component and a time component. Our guide to GDPR and consent on WordPress covers setting up a banner.
How to choose
By profile
- You already use Google’s tools (Ads, Search Console): Site Kit, with consent mode and a cookie management tool.
- You sell with WooCommerce and want GA4 sales reports: MonsterInsights, on the Pro plan.
- You want professional-grade detail with no transfer: Matomo, on solid hosting.
- You run a blog or content site: WP Statistics, Koko Analytics in cookieless mode, or Independent Analytics with the daily salt renewal on.
- You do not want to maintain anything: Plausible.
The rule of caution
Whatever the tool, check its default mode, turn off what falls outside the exemption if you rely on it, and mention audience measurement in your privacy policy, with a way to object. If you sell online, cross-check this choice with your WooCommerce plugins, which sometimes send order data themselves.
Summary table
| Plugin | Where data goes | Cookie by default | Entry price (Oct. 2026) |
|---|---|---|---|
| Site Kit by Google | Google Analytics | Yes (GA4 cookies) | Free |
| MonsterInsights | Google Analytics | Yes (GA4 cookies) | $99.50 first year |
| ExactMetrics | Google Analytics | Yes (GA4 cookies) | $99.50 first year |
| Matomo | Your database | Yes (can be turned off) | Free, paid add-ons |
| WP Statistics | Your database | No | Free, $119 per year |
| Burst Statistics | Your database | Yes | Free, $49 per year |
| Independent Analytics | Your database | No | Free, $49 per year |
| Koko Analytics | Your database | Yes (expires at midnight) | Free, €59 per year |
| Plausible | Vendor’s European servers | No | $9 per month |
| Jetpack Stats | WordPress.com (Automattic) | Not documented | Free (personal), paid (commercial) |
Frequently asked questions
Is Google Analytics legal in Europe in 2026?
Transfers to Google have rested since September 2023 on the Data Privacy Framework, in force since July 2023 and still in October 2026 despite challenges. The 2022 and 2023 decisions concerned the earlier period. In France, Google Analytics is not designed to meet all the CNIL criteria for exempt measurement (aggregated statistics, no campaigns, no individual tracking, provider acting only as processor): in practice, its cookies remain subject to consent.
Do I need a banner with Matomo?
Not necessarily, if Matomo is configured according to the exemption conditions: anonymized IP addresses, limited durations, marketing features turned off, notice and a right to object. Matomo publishes the precise list of settings for its Cloud and On-Premise editions; the WordPress plugin runs on the same engine, but is not named in that self-assessment.
Is cookieless analytics outside the GDPR?
No. It can do without a banner if it meets the exemption conditions, but informing visitors, the right to object and the other GDPR obligations still apply. And the absence of cookies is not enough, since other tracking techniques are also covered.
Can I run GA4 and a self-hosted plugin together?
Yes: the self-hosted tool, configured for the exemption, measures without a banner every visitor who does not object, while GA4 only measures visitors who accepted. Just keep in mind that the two tools’ numbers will not match.
Which one slows the site down least?
Koko Analytics is the lightest, with a script under one kilobyte and collection that bypasses WordPress. Matomo running inside WordPress is the most demanding. GA4 connectors load Google’s script, heavier than a local counter.
What if the Data Privacy Framework falls?
Transfers to Google would then lose the legal basis they have relied on since 2023, as happened to the Privacy Shield in 2020. Sites using a Google connector would have to fall back on other safeguards, whose sufficiency European authorities had already questioned, or switch tools. A self-hosted tool on a European server, or a European service, would not be affected by that question.
Conclusion
The right statistics plugin depends first on where you accept that your visitors’ data goes. Google connectors offer depth and advertising integration, at the cost of consent. Self-hosted tools offer control, provided they are configured properly.
The Tele2 case shows that the site operator answers for the tool it installs, and that the rules can change along the way. Choose a tool whose workings you understand, configure it accordingly, and tell your visitors clearly.
Sources
- CNIL (July 2025). Cookies : solutions pour les outils de mesure d’audience (in French)
- CNIL (July 2025). Self-assessment tool, consent-exempt audience measurement (in French)
- CNIL (November 2023). Audience measurement and data transfers (in French)
- CNIL. US adequacy: first questions and answers (in French)
- CNIL via EDPB (February 2022). Decision ordering compliance, Google Analytics (redacted)
- noyb (January 13, 2022). Austrian DSB: EU-US data transfers to Google Analytics illegal
- noyb (August 17, 2020). 101 Complaints on EU-US transfers filed
- IMY (July 3, 2023). Four companies must stop using Google Analytics
- IMY (June 30, 2023). Decision, Tele2 Sverige AB, DI-2020-11373 (in Swedish)
- IMY (October 16, 2025). Appeal court confirms Tele2 fine (in Swedish)
- Court of Justice of the EU (September 3, 2025). Press release 106/25, Latombe v Commission
- EDPB (July 31, 2026). Letter to the European Commission on US Supreme Court judgment
- EDPB (October 2024). Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive
- Google. Advertising and analytics products: international data transfers
- Google Analytics Help. IP masking in Google Analytics
- Site Kit by Google. Consent mode
- Matomo. Configure Matomo to comply with CNIL consent exemption
- Plausible. Data policy
- Independent Analytics. What refreshing the visitor salt every day means
- Jetpack. Jetpack Stats
- WordPress.org (October 2026). Burst Statistics
- WordPress.org (October 2026). WP Statistics
- noyb (April 5, 2022). Update: CNIL decides EU-US data transfer to Google Analytics illegal
- CNIL, via EDPB (March 2, 2022). Formal notice decision, audience measurement
- Austrian Data Protection Authority (December 22, 2021). Google Analytics decision
- IMY. Tele2 Sverige AB (tele2.se)
- Garante per la protezione dei dati personali (June 2022). Google Analytics decision
- CNIL. Cookies and trackers FAQ
- EUR-Lex (2025). Case C-703/25 P, Latombe appeal
- WordPress.org. Independent Analytics
- MonsterInsights (October 2026). Pricing
- Google Site Kit. Consent mode
LaFactory designs, builds and maintains WordPress and WooCommerce sites, audience measurement included, and develops its own plugins. Talk to us about your WordPress project.