Privacy-Friendly Analytics Compared by Page Weight

Analytics is the one third-party script almost every static site keeps, which makes its cost worth measuring precisely. A static page with 10 KB of its own JavaScript can easily load 150 KB of analytics, set cookies that require a consent banner, and spend more main-thread time on tracking than on the page itself. The newer privacy-focused tools promise the opposite: a script of a kilobyte or two, no cookies, and often no consent banner — but they also report less.

This comparison loaded five analytics setups on the same page of a static documentation site, one at a time, and measured script size, requests, main-thread time, effect on Core Web Vitals, cookies and what each could report. It belongs to Third-Party Script Performance on Static Sites; the self-hosting option is covered in Self-Hosting Analytics to Cut Third-Party Requests.

Method

• Page: a 1,400-word docs article from an Astro site, 9 KB of own JavaScript, served from Cloudflare.
• Tools: Plausible (hosted), Fathom (hosted), Umami (self-hosted on a small VM), Cloudflare Web Analytics (beacon), Google Analytics 4 (gtag.js, default configuration, no tag manager).
• Each installed exactly as the vendor documents, with defer or async as recommended.
• Measurement: WebPageTest Moto G Power on 4G, first view, nine runs; Chrome Performance panel with 4× CPU throttling for main-thread time; one custom event (outbound link click) configured in each.
• Field: each tool ran for one week in turn on the production site, with web-vitals RUM recording INP.

Weight and Requests

GA4's script is large because gtag.js is a general-purpose tag library: it includes consent mode, enhanced measurement listeners for scrolls, outbound clicks, video and site search, and the logic for many Google products. The lightweight tools do one thing.

Effect on Core Web Vitals

The four lightweight tools were indistinguishable from no analytics within measurement noise. GA4 added about 90 ms to lab LCP (bandwidth contention on 4G), 60 ms of blocking time, and about 14 ms to field INP — not dramatic on its own, but GA4 also required a consent banner on this site, whose own cost is covered in Fixing LCP Regressions Caused by Cookie Consent Tools.

Cookies and Consent

The "usually not" column reflects how these tools are commonly assessed; it is not legal advice, and some jurisdictions or configurations differ. For this site, dropping GA4 meant dropping the consent banner too, which removed a further 38 KB of consent script and its layout and LCP effects.

What Each Reports

The site's team listed the reports they had looked at in GA4 over six months: page views by page, referrers, campaigns, search terms from the site's own search, and outbound clicks to the product signup. Every one was available in all four lightweight tools. The deciding factors among those were hosting preference and price.

Ad Blockers and Accuracy

Analytics blocked by browser extensions under-count visits. Comparing each tool's page views with server-side request logs for the same week (excluding bots by user agent and known ranges): Cloudflare Web Analytics counted 91% of human page views, Plausible 81% (69% before proxying), Fathom 83%, Umami on the site's own subdomain 88%, and GA4 62%. Proxying the script and event endpoint through the site's own domain recovered most of the gap for Plausible. A technical audience blocks more than average, so treat these as indicative for developer-facing sites.

Switching Without Losing History

The site moved from GA4 to Plausible after the comparison. Three steps kept continuity. Both ran in parallel for four weeks, with GA4 still behind consent, so the team could compare the new numbers with familiar ones and agree on how much the blocked share explained. Historical GA4 reports for the previous two years were exported to CSV and stored with the site's documentation, since the property would eventually be closed. And custom events were recreated with the same names — outbound-click, signup-cta, docs-search — so dashboards and weekly reports changed their source but not their vocabulary.

The consent banner was removed in the same release as GA4, after a review by the company's privacy contact of what the new tool collects. That release alone cut 122 KB of third-party JavaScript from every page view and removed the only render-blocking third-party request the site had.

Verdict

• For most static content sites: a lightweight cookieless tool. Plausible or Fathom for hosted convenience, Umami for self-hosting, Cloudflare Web Analytics if the site is already on Cloudflare and basic reports suffice. Each costs readers nothing measurable.
• Keep GA4 only if you use what only it provides — advertising integration, cohort analysis, BigQuery export at scale — and accept the consent banner and its costs. If you do, load it after consent and after interaction, as in Loading Google Tag Manager Without Hurting INP.

Pitfalls

• Comparing tools on features you never use. List the reports you actually opened.
• Forgetting the consent banner's cost. It belongs in GA4's column.
• Trusting any single count. Compare with server logs once to know your blocked share.
• Leaving GA4 running alongside the new tool for months. Run both for a few weeks to compare, then remove one.

Conclusion

On the same static page, four privacy-focused analytics tools added under 2.5 KB of script and no measurable effect on LCP, TBT or INP, set no cookies, and reported everything this site's team actually used. GA4 added 84 KB, 60 ms of blocking time, about 14 ms of field INP and a consent banner. For a content site, the lightweight tools are the better default.

FAQ

Which analytics tool is lightest for a static site?

In the measurements in this guide, Cloudflare Web Analytics and Plausible were lightest at under 2 kilobytes of compressed script and under 5 milliseconds of main-thread time on a throttled phone. Fathom and Umami were close behind. Google Analytics 4 through gtag was about 50 times heavier in transferred bytes and around 20 times in main-thread time.

Do cookieless analytics tools need a consent banner?

It depends on the jurisdiction and the tool's configuration, and you should take your own legal advice. Tools that set no cookies, store no personal data and do not track across sites are often used without a consent banner in the EU, while GA4 is generally treated as requiring consent. Not needing a banner also removes the banner's own performance cost.

What do lightweight analytics tools not report?

Generally anything that requires identifying a visitor across sessions or sites, such as returning-user cohorts, cross-device journeys, demographics and advertising audiences. They report page views, referrers, campaigns, devices, countries and custom events. For most content sites that covers what is actually used.

Can I self-host analytics to avoid third-party requests?

Yes. Umami and Plausible can be self-hosted, and any of the tools can be proxied through your own domain so the script and events go to first-party URLs. That removes the third-party connection and avoids blockers, though it means operating the service or the proxy yourself.

Related

• Parent: Third-Party Script Performance on Static Sites — third-party costs.
• Self-Hosting Analytics to Cut Third-Party Requests — first-party analytics setups.
• Loading Google Tag Manager Without Hurting INP — if GA4 stays.
• Fixing LCP Regressions Caused by Cookie Consent Tools — the banner's cost.
• Tracking Deploy Markers in Analytics — using analytics alongside deploys.