GDPR checklist for analytics tools.
Analytics tools collect visitor identifiers and behaviour, which usually brings cookies and consent into play. Compare 25 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 PostHog | Usually a processor | Set per account or project | Obtained through the vendor |
 Google Analytics | Usually a processor | Set per account or project | Obtained through the vendor |
 Mixpanel | Usually a processor | Set per account or project | Published by the vendor |
 Amplitude | Usually a processor | Set per account or project | Published by the vendor |
 Plausible | Usually a processor | Usually the European Union | Published by the vendor |
 Hotjar | Usually a processor | Set per account or project | Published by the vendor |
 Segment | Usually a processor | Set per account or project | Published by the vendor |
 RudderStack | Usually a processor | Set per account or project | Published by the vendor |
 Fathom Analytics | Usually a processor | Set per account or project | Published by the vendor |
 Matomo | Usually a processor | Often the European Union, check your account | Published by the vendor |
 Heap | Usually a processor | Set per account or project | Obtained through the vendor |
 FullStory | Usually a processor | Set per account or project | Obtained through the vendor |
 Mouseflow | Usually a processor | Set per account or project | Published by the vendor |
 Lucky Orange | Usually a processor | Often the United States, check your account | Published by the vendor |
 Smartlook | Usually a processor | Set per account or project | Published by the vendor |
 LogRocket | Usually a processor | Set per account or project | Obtained through the vendor |
 Pendo | Usually a processor | Set per account or project | Published by the vendor |
 Userpilot | Usually a processor | Set per account or project | Obtained through the vendor |
 Appcues | Usually a processor | Set per account or project | Published by the vendor |
 WalkMe | Usually a processor | Set per account or project | Published by the vendor |
 Adobe Analytics | Usually a processor | Set per account or project | Published by the vendor |
 Simple Analytics | Usually a processor | Usually the European Union | Obtained through the vendor |
 Umami | Usually a processor | Set per account or project | Published by the vendor |
 Pirsch | Usually a processor | Often Germany, check your account | Published by the vendor |
 Clicky | Usually a processor | Often the United States, check your account | Published by the vendor |
What to check for analytics tools
- Check whether the tool sets cookies or reads device data, and what consent that requires.
- Say in your privacy policy what is measured and for how long it is kept.
- Review IP address handling, data retention and the data region settings.
- Confirm whether the provider uses the data for its own purposes.
All analytics tools
- PostHogAnalytics
- Google AnalyticsAnalytics
- MixpanelAnalytics
- AmplitudeAnalytics
- PlausibleAnalytics
- HotjarAnalytics
- SegmentAnalytics
- RudderStackAnalytics
- Fathom AnalyticsAnalytics
- MatomoAnalytics
- HeapAnalytics
- FullStoryAnalytics
- MouseflowAnalytics
- Lucky OrangeAnalytics
- SmartlookAnalytics
- LogRocketAnalytics
- PendoAnalytics
- UserpilotAnalytics
- AppcuesAnalytics
- WalkMeAnalytics
- Adobe AnalyticsAnalytics
- Simple AnalyticsAnalytics
- UmamiAnalytics
- PirschAnalytics
- ClickyAnalytics
Questions, answered.
What should I check before using an analytics tool under the GDPR?
Check whether the tool sets cookies or reads device data, and what consent that requires. Say in your privacy policy what is measured and for how long it is kept. Review IP address handling, data retention and the data region settings. Confirm whether the provider uses the data for its own purposes.
Do I need a data processing agreement with an analytics provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which analytics tools does Privacyboard cover?
PostHog, Google Analytics, Mixpanel, Amplitude, Plausible, Hotjar, Segment, RudderStack, Fathom Analytics, Matomo, Heap, FullStory, Mouseflow, Lucky Orange, Smartlook, LogRocket, Pendo, Userpilot, Appcues, WalkMe, Adobe Analytics, Simple Analytics, Umami, Pirsch, Clicky. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.