Privacy-first web analytics converged on the same homepage: no cookie banner for this script, a small JS file, pages and referrers, a monthly price. Plausible, Fathom, Simple Analytics, and a dozen others already occupy that slot. Another dashboard that counts pageviews without _ga is not a reason to switch.
SiteLine only belongs in this set if you also need Google Search Console as a first-class dataset — 16 months (Google's documented retention) backfilled from whatever Google still holds, kept while you subscribe, 25,000 rows per day per report — and you want that dataset, plus the on-site series, queryable by an AI client over two read-only MCP servers. If you do not, buy one of the mature cookieless counters and stop reading vendor blogs, including this one.
This is the tool-by-tool comparison. If you are leaving GA4 and have not yet decided what job the replacement does, start with GA4 alternatives. For GA4 specifically, use SiteLine vs Google Analytics. For the Plausible and Matomo choice, see Plausible vs Matomo. For self-host, open-source web analytics. Identity internals: cookieless vs GA4. How the daily unique is defined: unique visitors without cookies. Chris Richards builds SiteLine at Aglet Technologies ([email protected]). The operator page is /trust.
Compare the mechanism, not the adjective
"Privacy-first" is not a spec. Ask how a unique visitor is computed, whether a cookie is written, how long the id lives, and what happens to IP addresses.
SiteLine: no first-party analytics cookie; fetch with credentials: 'omit'; visitor id is the SHA-256 of truncated IP (IPv4 /24, IPv6 /48) plus user agent plus a rotating daily salt; the hash resets at UTC midnight; the raw IP is not stored on the event; hostname allowlist; known bots dropped before quota. Custom events: 10 properties, key at most 64 characters, value at most 256. Goals and funnels are derived in the UI, not extra billable events.
Peers differ. Some hash IP and user agent without a daily salt. Some offer an optional first-party cookie when you want stickier uniques. Some are cookieless in the browser and still see full IPs in server logs. Do not copy their marketing sentence into your privacy notice. Read their current policy the same day you read ours: /privacy and /docs/privacy.
A useful comparison is the lifetime of the identifier, because that lifetime is the product.
| Question to ask the vendor | Why it changes the chart | SiteLine's answer |
|---|---|---|
| Is a cookie written by this script? | Banners, blockers, and what "unique" can mean | No analytics cookie |
| Does the id survive midnight? | Returning visitors, cohorts, "users this month" | No. Salt rotates at UTC midnight |
| Is the raw IP stored on the hit? | What a breach or a subject request contains | Not stored on the event |
| Can two people share an id for a day? | Whether uniques are a headcount | Yes, same truncated network and user agent |
| Are rare search queries in the table? | Whether a query export matches the chart | No. Google withholds anonymized queries |
That last row is not a SiteLine invention. Google's Performance data deep dive says anonymized queries — those not issued by more than a few dozen users over a two-to-three month period — are omitted from the table and still included in chart totals, unless you filter by query. Google's own illustration on that page is four named queries (150, 125, 100, and 75 clicks) summing to 450, against a chart total of 550. The 100-click gap is the withheld queries. Any tool that imports Search Console, including SiteLine, inherits that gap. A cookieless counter that never imports Search Console does not have the gap, because it does not have the table.
The buying test: five questions
Ranked "best of" lists are the same ten vendors in a different order. In 2026 the real constraint is still identity, so run this test before you compare logos. SiteLine passes some rows and fails others, and so do Plausible, Fathom, Matomo and GA4.
- What must "visitor" mean in a board slide? If it must mean the same human across a month, you need a cookie, a login or a CRM, and SiteLine will not do that. Fail it on purpose if the KPI is 28-day retention of people. If "visitor" may mean a daily unique that includes people who rejected the consent banner, cookieless is in. Confirm in the network tab that the vendor does not set a cookie anyway.
- Do you need query-level SEO next to on-site data? If organic is incidental, a small cookieless counter is enough. If you argue about landing pages and queries, you need Search Console data that survives Google's 16-month window and the 1,000-row UI export. Otherwise you live in two products with two date pickers.
- Will an agent be allowed to read it? If people already paste screenshots into ChatGPT, either forbid that or authorise a read-only MCP server with team-scoped tokens. That is extra data sharing, described in /privacy. If it is unacceptable, leave it off.
- What must you not buy by accident? Session replay, heatmaps, user-level identity across days, Mixpanel-class product analytics, Ads attribution, BigQuery export, self-hosting. SiteLine ships none of those. Matomo and PostHog-shaped tools do some of them and pull you back toward consent banners. Treat replay as a different purchase.
- Can you explain collect in one sentence? SiteLine: a deferred
/js/script.js,POST /api/analytics/event, an optional proxy for those two paths, a hostname allowlist, bots filtered. If a vendor cannot give you the equivalent sentence, you will debug it in production.
Fill the "Must / nice / no" column before you colour any cell green. Unlimited domains and Search Console sites only matter if you have more than one origin.
| Requirement | Must / nice / no | GA4 | Hosted cookieless peer | Self-host | SiteLine |
|---|---|---|---|---|---|
| No analytics cookie | Fail by default | Usually pass | Varies | Pass (this tracker) | |
| Cross-day person | Yes | Rarely | Optional | Fail, by design | |
| Search Console history kept past 16 months | Not a substitute | Often fail | DIY | Pass while subscribed | |
| MCP / agent access | Fail | Rare | DIY | Pass, read-only | |
| Replay | Extra | Extra | Plugins | Fail | |
| Ads attribution | Pass | Fail | Extra | Fail | |
| Price you can explain | $0 plus consent tooling | Per site or views | Staff time | $4.99 / 1M events; $19.99 / 10M; $99.99 + $2.99 / extra 1M | |
| Overflow behaviour | n/a | Hard stops vary | Disk | Soft hide on Starter and Growth; Scale meters | |
| Exit | Data stays in Google | Varies | Your disk | 30-day analytics grace, then purge; CSV |
"Best" does not mean the highest unique-visitor count, since a cookied tool reports fewer users where consent is refused and more where identity persists. It does not mean closest to GA4 either: GA4 applies data thresholds and sampling to some reports, which is a cost, not a feature (see GA4 sampling and thresholds). It means you can defend the number in the room you actually have, whether that is legal, SEO or product. For many public SaaS and content sites that is cookieless pageviews, a daily unique, goals on a thank-you page, and Search Console that still has last year's queries.
The table that is usually missing
| Typical cookieless counter | SiteLine | |
|---|---|---|
| Pageviews, referrers, devices | Yes | Yes, plus UTMs, live view about 30 minutes |
| Cookie for this tracker | Usually no | No |
| Unique visitor lifetime | Vendor-specific, often daily or salted | Explicitly daily, UTC |
| Search Console import | Sometimes a thin add-on, often absent | Core: webmasters.readonly, 16-month backfill, refresh every 4 hours of the last 7 days including fresh rows, CTR computed |
| GSC row budget | Not applicable, or whatever the UI shows | 25,000 rows per day per report. The UI export is 1,000. The API can expose up to 50,000 |
| Retention of GSC after Google drops the day | Not applicable | Kept for the life of the subscription |
| MCP / agent access | Rare | Two read-only servers: Search Console and on-site analytics |
| Product analytics | No | No, on purpose |
| Replay / heatmaps / Ads / BigQuery | No | No |
| Self-host | Sometimes (Plausible CE and others) | No |
| First-party script hosting | Custom domain features vary | You proxy /js/script.js and POST /api/analytics/event; no managed CNAME in v1 |
| Pricing unit | Often per domain or pageviews | Shared event pool; unlimited domains and GSC sites |
| Entry price | Check the vendor's current public pricing | $4.99 / 1M events; Growth $19.99 / 10M; Scale $99.99 + $2.99 / extra 1M |
We are not going to paste Plausible's or Fathom's price list and get it wrong next month. Their products are good at being small analytics. SiteLine's wedge is Search Console plus the same cookieless discipline, in one subscription. If a peer's page says they are "more private", ask for the hash recipe and the IP retention line, then compare it to /docs/privacy. Adjectives do not survive that exercise.
Worked example: the 24,000 rows a counter never stored
Labeled hypothetical. Not a customer. Not a benchmark against Plausible, Fathom, or Simple Analytics. Those products are not failing a test they did not enter. The numbers are row caps.
Call the day Tuesday. One property. Web search. Queries dimension.
The Search Console UI shows 1,000 query rows. Export it and Google's export help still describes the file: truncated to 1,000 representative rows. Smaller sites may already have most or all of their data in that file. Larger sites have more. The chart total is the actual total, not the sum of the truncated rows.
The deep dive puts the API above the UI. The interface exports at most 1,000 rows. The Search Analytics API's upper limit is 50,000 rows per day per site per search type, which may not be reached. The API defaults to 1,000. rowLimit raises a response to 25,000. startRow requests the following page, rows 25,001 through 50,000. Google's retrieval guide says the same 50,000-row cap per day per search type, tells you to query one day at a time so you stay inside quota, and says data is typically available after 2–3 days. It also warns that asking for page or query dimensions can drop data so the query finishes. That drop is separate from anonymization and separate from SiteLine's cap.
SiteLine's import for Tuesday's query report holds 25,000 rows. It does not hold 50,000. The UI export holds 1,000. The arithmetic the hypothetical is for: 24,000 query rows are in the import and absent from the UI export. A cookieless counter with no Search Console import holds zero of them. That is the column this page exists to add. If Tuesday's site already fits in 1,000 rows, the 24,000 figure does not apply, and you should not buy SiteLine to recover a tail you do not have. The write-up of the ceiling is Search Console's 1,000-row limit.
Even a small site still hits the other limit. Google's Performance report is a rolling window. The horizon teams plan around is 16 months of whatever Google still holds. Days that age out of that window leave the Search Console interface. SiteLine backfills whatever Google still holds, then keeps each imported day while the subscription is active. How the window behaves is Search Console's 16-month limit. A peer that shows recent referrals and never stored the query table cannot answer what a URL ranked for last spring.
Rules that apply to every row in that import, including the hypothetical Tuesday:
- Clicks are not sessions and not SiteLine visitors. See clicks vs sessions.
- Do not average CTR across rows. CTR is a fraction of 1. Google's API returns values like
0.02515, which is about 2.5%, not the number 2.5 stored as a rate you can average. - Do not average position across rows. Position is impression-weighted.
- Do not sum query rows and expect the chart total. Anonymized queries and row caps both sit in that gap.
The Performance report overview is still the right page for the metric definitions a human sees: clicks, impressions, CTR as clicks divided by impressions, and average position. The chart is property-aggregated. Table aggregation changes with the dimension. Use it for definitions. Use the deep dive for the row caps.
Unlimited domains is not a footnote
Agencies and multi-product companies get punished by per-site pricing. SiteLine's quota is billable events (pageviews plus custom events) across unlimited analytics domains, and the same subscription includes unlimited Search Console sites. Starter and Growth hide post-cap data in charts until you upgrade. Ingest continues. That is a soft cap, not a dropped event. Scale is $99.99 and then $2.99 per extra million events. It does not hide overflow; it meters it. The trial is 7 days, no card to start, with visibility of about 50,000 events. After access ends, analytics has a 30-day grace period. CSV export, not a warehouse.
If your current vendor charges per domain, do the arithmetic on the number of hostnames you actually measure before you congratulate yourself on leaving GA4. SiteLine's event pool is shared. A quiet marketing site and a busy docs site draw from the same million (Starter) or the same ten million (Growth).
Agents make the import usable
A 16-month query table that only lives in a web UI is how you end up exporting a 1,000-row CSV on Fridays again. SiteLine ships two read-only MCP servers on every plan:
| Server | What it can answer | What it must not be asked |
|---|---|---|
| Search Console | Queries, pages, clicks, impressions, position, movers, coverage dates | To invent clicks for dates after data_through, or to sum rows into the site total |
| On-site analytics | Pageviews, daily visitor hashes, events, goals, a short live view | For impressions, rank, or a person who returned next week |
MCP calls are not billable events. Search Console rows are not billable events. Pageviews and custom events are. The servers cannot submit sitemaps, request indexing, or edit Search Console users. A token is team-scoped. Connecting a client is a data-sharing decision, and it is described in the privacy policy. Disconnect Google, or the agent, when you want it stopped.
Freshness is part of the contract with the model. The retrieval guide's "typically available after 2–3 days" is Google's advice for a finalized day. SiteLine also imports fresh rows and reimports the last 7 days every 4 hours, so the newest day can still move. Tools are supposed to return coverage dates. An answer that ignores them is a hallucination with citations. The agent-facing write-up is SEO analytics for AI agents.
What this comparison refuses to be
It is not a ranked "best of" list with scores. It is not a claim that SiteLine is more private than Plausible or Fathom as a slogan. It is not Mixpanel, and it is not session replay. It does not include a street address, a customer logo, or a percentage of teams who switched. Those would be fiction.
Install the counter with /docs/script or /docs/react. Packages: @siteline.tools/tracker and @siteline.tools/react. A first-party collect path is your proxy, documented at /docs/proxy. Signup: /register. Billing: /docs/billing.
FAQ
Is SiteLine "more private" than Plausible or Fathom?
Not as a slogan. All three, plus others, can be cookieless. SiteLine's hash is daily and documented: truncated IP, user agent, rotating salt, reset at UTC midnight, raw IP not stored on the event. Compare that recipe to the vendor you are actually buying, on the day you buy. The honest differentiator on this page is Search Console retention and two read-only MCP servers, not a purity contest.
Why is this not a numbered top ten?
Orderings without a job are affiliate pages. Plausible can be the best cookieless counter for a single blog, Matomo the best on-prem mandate, GA4 the best Ads pipeline. SiteLine is the best fit when you want cookieless on-site data and durable Search Console in one account.
Does privacy analytics mean we can skip a privacy notice?
No. Cookieless means no analytics cookie is written. A hashed, truncated IP plus user agent can still be personal data, so publish a notice. SiteLine's is at /privacy. Your site needs its own.
What if we fail the SiteLine rows and still dislike GA4?
Pick a hosted cookieless peer without Search Console retention, self-host (open-source web analytics), or split GA4 for Ads from a cookieless tag on the content site. The expensive mistake is one tool asked to do all three.
Do you store CTR from Search Console?
No. Clicks and impressions are stored. CTR is computed when a report is shown. Average position comes from Google. Anonymized queries never arrive, which is why query rows do not sum to the chart total. Do not average the computed CTR across rows. It is a fraction of 1.
Can I use SiteLine only for Search Console and skip the script?
Yes. Unlimited Search Console sites are on every plan. The tracker is optional per domain. You still pay a subscription. Analytics event quota sits unused if you send nothing. The trial's visibility of about 50,000 events only matters if you ingest on-site events. The 25,000-row daily cap still applies to each imported report.
What are the two MCP servers?
One is Search Console, read-only, over the import described above. One is on-site analytics: pageviews, the daily hash, events, and goals. They share a subscription and can share a token. They do not share a unit. A click is not a visitor. Details and the failure modes are in SEO analytics for AI agents.