DEV Community

Cover image for Self-Hosted Plausible vs GA4: GDPR by Default (2026)
Mahdi BEN RHOUMA
Mahdi BEN RHOUMA

Posted on Originally published at iloveblogs.blog

Self-Hosted Plausible vs GA4: GDPR by Default (2026)

#plausible #googleanalytics #ga4 #gdpr

Google Analytics 4 is the most-deployed web analytics tool on Earth, and one of the most legally exposed in the European Union. Since the Austrian DPA ruled in January 2022 that Google Analytics transfers user data to the US in violation of GDPR, similar rulings have followed in France, Italy, Denmark, Finland, Norway, and Sweden. Google replaced the Safe Harbor and Privacy Shield legal bases with the EU-US Data Privacy Framework in July 2023, but that framework is itself under legal challenge — Max Schrems and noyb have asked the European Commission to withdraw it and the case is pending at the EU's top court. If your business serves EU customers and you want a tool that is GDPR-compliant by default rather than by configuration, self-hosted Plausible Analytics is the simplest answer.

The two architectures side by side

Self-Hosted Plausible Google Analytics 4
Data location Your server, your jurisdiction Google Cloud, United States
Personal data collected None (cookieless, no IP storage) IP addresses, device IDs, cross-site IDs
Consent banner required No (no personal data) Yes (mandatory under GDPR/ePrivacy)
Cookie storage None _ga, _ga_*, _gid
Script weight ~1 KB (self-hosted) / 2.5 KB (cloud) 45 KB+ (80 KB+ with Tag Manager)
Open source AGPLv3 Proprietary
Data export Built-in CSV / JSON BigQuery export (free tier limited)
Heatmaps / session recordings No No (use Hotjar, Microsoft Clarity, PostHog)
Google Ads Smart Bidding No Yes (conversion API integration)
Multi-touch attribution No (last-click only) Yes (data-driven attribution)
Legal status in EU (2026) Compliant by default Under legal challenge; compliant only with consent + DPA + Consent Mode v2

The single biggest difference is the legal posture. Plausible does not collect personal data, so GDPR does not apply to it in the same way. GA4 does collect personal data, so GDPR requires a lawful basis — typically explicit consent via a banner — and a Data Processing Agreement with Google. The DPAs that exist for GA4 are valid only as long as the EU-US Data Privacy Framework holds. If the framework is struck down (as Privacy Shield was in July 2020), GA4 users in the EU face the same situation they did in 2022.

Why script weight matters for SEO

GA4's 45 KB script is not just an inconvenience — it directly affects Core Web Vitals, which Google uses as a ranking signal. The script blocks the main thread on initial parse, especially on low-end mobile devices, and Lighthouse flags it as a render-blocking resource on most sites. Plausible's script is 1 KB self-hosted, 2.5 KB on Plausible Cloud. The measurable difference on a typical content page:

  • Largest Contentful Paint (LCP) — 100-300 ms faster on mobile 4G with Plausible.
  • Total Blocking Time (TBT) — 50-150 ms less blocking time.
  • Time to Interactive (TTI) — measurable lift on pages with heavy interactive elements.

For an EU audience on mid-range Android handsets (the largest share of mobile traffic in most EU countries), this difference can move a page from "Good" to "Needs Improvement" on Core Web Vitals. For SEO, the lightest analytics that still gives you actionable data wins.

Setup: self-host Plausible on a Hetzner VPS

Plausible ships as a single Docker image backed by PostgreSQL and ClickHouse. The official self-hosting docs cover Kubernetes and Docker Compose; the simplest path for a single site is Docker Compose on a small EU VPS.

1. Provision a server 

# Hetzner Cloud Console: create a CPX21 (4 GB RAM, 2 vCPU) in Falkenstein, DE
# Cost: €4.85/month ex VAT
# Or: Scaleway Stardust S-1 in Paris, FR (1 GB RAM, €1.99/month, handles <500K pageviews)
Enter fullscreen mode Exit fullscreen mode

For most sites with under 1M pageviews/month, a 2 vCPU / 4 GB RAM instance is more than enough. Plausible's reference deployment serves 10M+ pageviews/month on a 4 vCPU / 8 GB setup.

2. Install Docker + Docker Compose 

ssh root@your-server
apt update && apt install -y docker.io docker-compose-plugin
systemctl enable --now docker
Enter fullscreen mode Exit fullscreen mode

3. Deploy Plausible 

mkdir -p /opt/plausible && cd /opt/plausible

# Download the official docker-compose.yml
curl -L https://raw.githubusercontent.com/plausible/hosting/master/docker-compose.yml -o docker-compose.yml

# Generate a secret base key
openssl rand -base64 64 | tr -d '\n' > .env
echo "BASE_URL=https://plausible.example.com" >> .env
echo "SECRET_KEY_BASE=$(cat .env | head -c 86)" >> .env

# Start the stack
docker compose up -d
Enter fullscreen mode Exit fullscreen mode

The compose file pulls plausible/plausible:latest, postgres:16-alpine, and clickhouse:latest. PostgreSQL stores user accounts and sites; ClickHouse stores the analytics events.

4. Put it behind HTTPS

Use Caddy for automatic Let's Encrypt:

plausible.example.com {
    reverse_proxy localhost:8000
    encode gzip zstd
}
Enter fullscreen mode Exit fullscreen mode 
apt install -y caddy
# Copy the Caddyfile to /etc/caddy/Caddyfile
systemctl reload caddy
Enter fullscreen mode Exit fullscreen mode

Caddy handles certificate renewal automatically. Cloudflare in front of the server is fine — set TLS to "Full" and add a DNS record pointing plausible.example.com to the server IP.

5. Add your first site

Visit https://plausible.example.com, create an admin account, and add a domain. Plausible returns a one-line snippet:

<script defer data-domain="example.com" src="https://plausible.example.com/js/script.js"></script>
Enter fullscreen mode Exit fullscreen mode

Add it to your site's <head> or via your framework's component (Next.js <Script strategy="afterInteractive">, Astro Layout.astro, Hugo head.html).

Migration playbook: GA4 → Plausible without losing data

You do not have to delete GA4 on day one. Many EU sites run both for a quarter — Plausible for the GDPR-clean dashboard, GA4 for the historical comparison. The steps:

  1. Stand up self-hosted Plausible (above).
  2. Add the Plausible snippet to your site alongside the existing gtag.js. They do not conflict.
  3. Run for 30 days, exporting GA4 weekly and comparing to Plausible. Independent benchmarks (such as the OSSAlt 2026 study) show Plausible captures 100% of traffic GA4 does when consent banners are off, and ~30-40% more when GA4 is gated behind consent (because visitors who decline are invisible to GA4 but counted by Plausible).
  4. Decide on a GA4 sunset. For most sites the comparison shows Plausible covers everything they actually used GA4 for (top pages, traffic sources, referrers, goals). Sites that depend on GA4's Google Ads conversion export or BigQuery attribution need a hybrid (Plausible for product analytics, GA4 in consent mode for Google Ads).
  5. Remove the GA4 script. Drop the gtag.js tag, the GA4 config block, and the Google Tag Manager container if you used one. Update your privacy policy.

What Plausible does not do (and what to use instead)

Be honest about feature gaps before you migrate:

  • No heatmaps — pair Plausible with Microsoft Clarity (free, EU data residency option) or PostHog (self-hosted, EU region).
  • No session recordings — PostHog or LogRocket.
  • No BigQuery export — Plausible exports CSV/JSON via API; for warehouse-grade export use a custom exporter or keep a stripped GA4 in consent mode for that pipeline.
  • No Google Ads Smart Bidding — keep GA4 conversion export active (in consent mode) if you bid on Google Ads; or move to server-side conversion API.
  • No user-level analytics — Plausible is intentionally aggregate-only; if you need user-level funnels, use PostHog or Amplitude EU region.
  • No custom dimensions beyond a small set — Plausible supports data-custom-prop-* attributes, but the schema is rigid.

For most content sites and SaaS landing pages, the missing features are not blockers. For e-commerce with heavy ad-spend attribution, the picture is different — talk to a privacy lawyer before ripping out GA4.

When to choose what

Choose self-hosted Plausible when:

  • Your customers are in the EU/UK and you want zero-consent analytics.
  • You want data on your own server (Hetzner, Scaleway, OVH) under your jurisdiction.
  • You do not depend on Google Ads conversion attribution or BigQuery.
  • Script weight matters for your Core Web Vitals.

Choose Plausible Cloud (EU region) when: you want the same analytics with zero ops — Plausible Cloud runs on Hetzner (DE), UpCloud (FI), and Bunny.net (SI). Slightly higher per-month cost, no server to maintain.

Choose GA4 when: you have explicit user consent, a signed DPA, a need for Google Ads Smart Bidding conversion import, BigQuery export, or multi-touch attribution. Document the legal basis in your privacy policy.

Choose PostHog EU region when: you need product analytics (funnels, retention cohorts, feature flags) in addition to web analytics. PostHog replaces GA4 + Hotjar + Mixpanel in one self-hostable stack.

The trend in 2026 is clear: every DPA ruling that touches GA4 strengthens the case for cookieless, EU-hosted analytics. Self-hosted Plausible is the lowest-friction path for EU developers who want to be compliant today and not have to react when the next court ruling lands.

Official references: Plausible vs Google Analytics, Plausible Self-Hosted docs, EU-hosted Plausible Cloud, GDPR.eu — official EU summary, noyb — Schrems II and DPF strategy.

Related Articles

Originally published at https://www.iloveblogs.blog

Top comments (0)