Is Umami GDPR Compliant? Complete Guide

Yes. Umami is GDPR-compliant out of the box. It does not use cookies, collect personal identifiable information, or enable cross-site tracking. You can deploy Umami without consent banners, cookie notices, or complex Data Processing Agreements. But there are exceptions: custom events, session replay, and integrations can pull you out of compliance if misconfigured. This guide explains what makes Umami compliant, where the risks are, and how to deploy it safely.

Is Umami GDPR-Compliant? The Short Answer

Yes, Umami is GDPR-compliant out of the box. It does not use cookies. It does not collect personal data that can identify you. Umami hashes visitor IDs and stores only aggregated analytics: pageviews, browser type, device, location, and referrer. None of this information is linkable to a real person. Under the GDPR's definition of "personal data," Umami's default behavior does not trigger consent requirements.

The practical implication: you can add Umami to your site and skip the cookie consent banner entirely. No regulatory burden. No negotiation with your data processor.

Why Umami Is GDPR-Compliant by Default

Umami's compliance stems from its architecture, not lawyers. The tool was designed for privacy from the ground up, which is why it avoids the compliance mess that GA4 forces on site owners.

Here's how Umami sidesteps GDPR friction:

No cookies. Umami tracks visitors using a hashed identifier stored in memory, not persisted to disk. This means no cookie banner. The GDPR requires consent for cookies that store persistent identifiers. Umami does not. Each browser session starts fresh.

No fingerprinting. GA4 and similar tools fingerprint users: they combine IP address, user agent, and device data to follow you across sites. Umami does not. It collects device data (browser, OS, screen size) only for the current visit, never to build a persistent profile.

No personal data collection. Umami does not ask for your name, email, phone, or user ID by default. It logs pageviews, referrers, browser and OS, device type, country and city (inferred from IP), and custom events you explicitly define. None of these, individually or combined, constitute "personal data" under GDPR Article 4. They do not identify you.

Contrast with Google Analytics. Google Analytics uses cookies to build a persistent user ID across multiple websites. It shares this data with Google's ad network. It links your behavior to your Google account if you are logged in. All of this requires explicit, informed consent under GDPR Article 7. Read our guide to Umami vs. Google Analytics to understand the compliance burden Google forces on site owners.

This architectural difference is why you see Umami used extensively in the EU, especially in regulated sectors (finance, healthcare, public sector). It is the default tool for privacy-conscious founders.

Self-Hosted vs. Umami Cloud: Different Compliance Models

Umami comes in two flavors: self-hosted and cloud-hosted. The GDPR implications differ.

Self-hosted Umami: You run the code on your own server or VPS. You own the database. You control where the data lives, who accesses it, and how long it is kept. Under GDPR, you are the data controller. Compliance is your responsibility, but you have full control. If your server is in the EU and you serve EU visitors, data never leaves EU borders. No Data Processing Agreement needed (you are not outsourcing the processing to a third party). This is the strongest compliance posture.

Deployment on Opsily, a managed hosting provider, gives you the control of self-hosted with the operational ease of a managed service. Opsily handles infrastructure, backups, and updates while you retain data ownership and control. You sign a processor agreement if required by your jurisdiction or organization.

Umami Cloud: Umami Inc. (or your cloud provider like Opsily) processes the data on your behalf. You are the controller; they are the processor. GDPR Article 28 requires a Data Processing Agreement. The agreement stipulates where data is stored, how long it is kept, and what happens if there is a breach. If the cloud provider's servers are outside the EU, you face additional friction around Standard Contractual Clauses (SCCs) and data transfers. Umami Cloud is compliant, but it adds a DPA negotiation step.

For teams in regulated industries (e.g., banks, insurance, healthcare), self-hosted on Opsily in an EU data center removes this friction entirely. For small sites, Umami Cloud is simpler and still GDPR-safe as long as you read and accept the processor agreement.

For a deeper look at Umami's features and deployment options, see our Umami analytics platform guide.

When Umami Compliance Can Break

Umami is not a magic shield. Compliance depends on configuration. Here are the failure modes:

Custom events with sensitive data. Umami lets you log custom events: form submissions, button clicks, video plays. By default, these are harmless. But if you attach sensitive data to an event (logging someone's email when they sign up, or their phone number, or their user ID), you are now collecting personal data. The event payload becomes subject to GDPR. You must ensure it is not stored, shared, or transferred without consent. Umami itself does not prevent this; it is your responsibility to avoid it.

Session replay. Umami offers a session replay feature (beta) that records visitor interactions on your site. This is optional and off by default. If enabled, it captures keyboard input, clicks, and form interactions. If a visitor types a password or credit card number in plain text, you have captured sensitive data. Session replay requires explicit consent under GDPR and is only useful for debugging, not analytics. Use it cautiously.

Third-party integrations. Umami can send data to external services: Slack, webhooks, data warehouses. Each integration adds a data processor. If you pipe Umami data to a service outside the EU, you add Data Processing Agreement obligations and potential SCC complexity. Check your integrations before claiming GDPR compliance.

Cross-border data transfer. Umami Cloud's data centers matter. If Umami Inc. or your provider stores data outside the EU for EU visitors, GDPR Article 5 (storage limitation) and Chapter 5 (international transfers) apply. Self-hosted in an EU data center avoids this entirely.

Inadequate privacy policy. You still need to disclose that you use analytics. Even though Umami does not collect personal data, you must tell visitors what you collect and why. No privacy policy means no compliance, regardless of how GDPR-friendly Umami is.

What Your Privacy Policy Must Include

You must publish a privacy policy. It does not need to be complex, but it must be visible and honest.

Minimum disclosures: you use a website analytics tool called Umami; Umami collects non-personal data (pages visited, device type, location, referrer); this data is not linked to your identity; no cookies are used; no data is shared with third parties unless you have integrations; data is retained for [X days] (specify your Umami retention setting).

Example language: "This site uses Umami Analytics to understand visitor behavior. Umami is a privacy-first analytics tool that does not use cookies or collect personal information. We collect the following non-personal data: pages you visit, your device type, browser, operating system, approximate location (inferred from IP address), and referring website. This data cannot identify you individually. It is not shared with third parties or sold to advertisers. Data is retained for 90 days, after which it is automatically deleted."

If you use Umami Cloud and have a Data Processing Agreement in place, add: "Our analytics provider acts as a data processor under a Data Processing Agreement. Your data is stored in [region]."

If self-hosted: "Umami runs on our own infrastructure. We are responsible for the security and privacy of your data. Your data is not shared with any third parties."

The privacy policy should be linked from your website footer or a dedicated privacy page. It satisfies GDPR Article 13 (transparency) and provides a compliance paper trail if regulators ask.

Umami vs. Competitors on GDPR

Plausible, Fathom, and Cloudflare Analytics are also GDPR-compliant by design. How does Umami compare?

Umami's advantages: Open source, free self-hosted option, full data ownership if self-hosted. No lock-in. On Opsily's managed hosting, you get the open-source benefits plus DevOps peace of mind.

Trade-offs: Umami's web interface is less polished than Plausible's or Fathom's. Reporting depth is shallower. You get pageviews, events, sessions, and basic cohorts--not the advanced segmentation or funnel analysis of paid competitors.

For a deeper comparison, check out our Umami vs. Plausible analysis.

For a startup or small business running on a tight budget, self-hosted Umami is the best value. For enterprises or high-traffic sites requiring white-glove support and advanced analytics, Plausible or Fathom makes sense.

How to Deploy Umami to Ensure Compliance

The safest deployment for GDPR is self-hosted in an EU data center.

Option 1: Self-hosted on Opsily. Deploy Umami via Opsily's managed hosting. Opsily handles infrastructure, backups, PostgreSQL updates, and security patches. You retain data ownership and control. Data stays in an EU data center. This is the middle ground: you get compliance guarantees without the DevOps overhead.

Sign a Data Processing Agreement with Opsily if required by your organization (banks, insurance, healthcare, or public sector all typically require one). The agreement specifies data location, retention, and breach notification.

Option 2: Self-hosted on your own VPS. Rent a VPS from a European hosting provider (Hetzner, OVH, or others). Deploy Umami using Docker. Run PostgreSQL locally. You manage backups and updates yourself. This gives you full control but requires hands-on infrastructure knowledge.

Option 3: Umami Cloud. Use Umami's official cloud service. Sign their Data Processing Agreement. Compliance is their responsibility, but you are bound by their terms (data retention, location, incident response).

Configuration checklist: (1) Disable custom events that log PII. (2) Set data retention to 30-90 days (not indefinite). (3) If self-hosted, enable HTTPS and firewall rules. (4) If using integrations (Slack, webhooks), ensure the downstream service is GDPR-compliant. (5) Publish your privacy policy. (6) Keep Umami updated (GitHub releases every few weeks).

Frequently Asked Questions

Do I need a cookie consent banner?

No, not with Umami's default settings. Umami does not use cookies. However, if you use custom events or session replay, review those features first to ensure you are not logging sensitive data.

Do I need a Data Processing Agreement?

Only if you use a cloud provider (Umami Cloud or Opsily managed hosting). Self-hosted Umami on your own infrastructure does not require a DPA.

Can I migrate from Google Analytics to Umami?

Yes. Export your GA4 historical data using GA's built-in tools. Set up Umami on your site (add the tracking script). Start collecting data in Umami. You can run both simultaneously during the transition, but they will report different numbers (GA4 will be higher due to consent bias and cross-site tracking).

What if I already use Google Analytics?

GA4 requires consent under GDPR. Switching to Umami eliminates the consent banner and simplifies your privacy obligations. This is the main appeal for EU-based teams.

Is Umami's GitHub community (39.3K stars) enough to trust it?

Umami is actively maintained (6,855 commits, recent activity). It is MIT-licensed, meaning no corporate lock-in. The community is large. However, "popular" does not mean "legally reviewed." Consult a legal expert in your jurisdiction for formal GDPR advice.

What is the difference between data controller and data processor?

You (the site owner) are the controller. You decide what data to collect and why. Umami (if cloud-hosted) or Opsily (if managed) is the processor. They process data on your behalf, following your instructions. GDPR Articles 24-28 define these roles.

Can I use Umami if I serve users in California (CCPA)?

CCPA has similar requirements to GDPR: no cross-site tracking, right to deletion, right to know. Umami's architecture satisfies CCPA as well. No cookie consent banner needed for Umami alone.

The Bottom Line

Umami is GDPR-compliant out of the box. It does not use cookies, does not track across websites, and does not collect personal data. If you are running a website in the EU and want analytics without consent banners, Umami is the answer. Self-hosted Umami on Opsily's managed infrastructure gives you compliance guarantees plus infrastructure peace of mind. But compliance depends on configuration: custom events, session replay, and third-party integrations can introduce personal data, shifting responsibility to you. Start with the default settings, publish a privacy policy, and you are compliant.

Deploy Umami on Opsily's managed hosting to skip the DevOps burden and get privacy-first analytics running in minutes.