The visitor who never blinks
Some of the traffic on a company site never blinks. It does not leave a tab open or a coffee going cold. Assistants and copilots fetch the page, summarize the pricing, and walk the documentation the way a junior analyst used to. For anyone responsible for demand, that is either a new channel or a distorted one.
The decision is narrower than a tool bake-off. Can you tell non-human visits from human demand, and does the log that answers the question stay on infrastructure you control?
Matomo, the analytics suite that began as Piwik, is described by its vendor as offering an “AI Assistants” report that splits visits from ChatGPT, Claude, Copilot, and other agents away from human traffic. That is a vendor description. It is not an audited method. The labeling rules, the error rate, and whether the report is free or paid have not been published in terms a board can check.
A trustworthy split would still change how a sales or web lead reads the site. An agent that grabs the pricing page and leaves is not a failed opportunity. Count it as one and you inflate sessions and sink engagement. Call a human an agent and you do the reverse: you undercount demand and may cut a page that is actually selling. Until the vendor shows the labeling rules, the known failure cases, and the price of the report, keep the chart out of the pipeline review. Ask for those three things. Do not book revenue off a label you cannot explain.
Owning the server is not owning the risk
Self-hosted analytics means you install the software and run it on machines you control, so the raw visitor feed does not have to pass through a third-party analytics vendor. Retention is your call. No outside analytics company has to see the unprocessed data. That matters more, not less, when customer journeys also feed your own models, agents, or sales automation.
The savings do not arrive as a smaller software invoice. They arrive as work: hosting, backups, updates, scaling, and someone who notices when the dashboard goes quiet. A short open-source license can still sit on a stack that wants several services and a person on call. Match the product to the admin capacity you have, not the capacity you hope to hire next quarter.
Privacy law does not vanish because the database sits in a private network you control. Self-hosting can remove the mess of shipping personal data to a processor in another jurisdiction. You still need a lawful basis to collect. Cookieless tracking is sometimes treated as a shortcut to consent-exempt measurement. Under some authorities, a narrow audience-measurement setup may qualify. It is not a general clearance. The rules that govern your visitors are the ones that count.
Four jobs, from a page counter to a platform
What follows is a fit guide, ordered from the lightest install to the heaviest, not a lab ranking. There is no independent benchmark, security audit, uptime figure, or total-cost study behind the order. Before any of these touches production, read the current docs and the license, confirm which modules are paid or cloud-only, and check the privacy rules that actually apply to you.
Ackee: numbers without a profile
- Job. Clean, page-level traffic numbers, and an explicit refusal to follow a person from session to session.
- What you operate. Ackee’s documentation describes a fully open-source tracker on Node.js and MongoDB. One instance can watch more than one domain. Documented paths have included Docker, a manual Node.js setup, and at times Heroku and Netlify. Confirm which presets the repository still supports.
- Privacy posture. The docs describe a multi-step process that strips identifying information before storage, and they say it uses no cookies. No cookie is a technical fact, not a lawful basis.
- Do not buy it if you need funnels, replays, experiments, or an agent-versus-human split.
Umami: the light traffic dashboard
- Job. Page and campaign truth without a heavy behavioral suite: what was viewed, where it came from, and which events fired.
- What you operate. An open-source app on a server you control, or Umami Cloud, fronted by a small script. Its documentation describes custom events such as button clicks or sign-ups, automatic UTM attribution, multi-channel attribution, and revenue tied back to traffic sources. Filters cover date, country, and device.
- Privacy posture. The same docs describe collection without cookies and without persistent tracking of one person across sites. Again, that is a product claim, not legal clearance.
- Do not buy it if you need session replay, in-product experimentation, or a classifier that separates AI agents from people. If a forecast depends on revenue by source, confirm that view in the current docs before you promise it.
Matomo: the long-running web suite
Matthieu Aubry started the open-source project as Piwik in 2007, with a stated mission of privacy and “100% control” of users’ own data. It took the Matomo name in 2018. The history page cites BuiltWith for a figure of more than 1.4 million websites in over 190 countries. That sentence lives in a passage framed as 2018. It is the number the page still displays, not a census taken this year.
The same history is a lineage of open core plus commercial extras: a tag manager, a Google Analytics importer, a WordPress release, paid advertising features, and a cloud milestone of more than 1 billion pageviews. Those headings are not a price list, and they are not a promise that every module in a comparison is free.
- Job. A mature web analytics suite: visits, acquisition, goals, commerce, and events, with optional depth for funnels, heatmaps, recordings, and tests.
- What you operate. Commonly described as a PHP application with MySQL or MariaDB, run on a host you control, with paid plugins sold around the free core. Exact versions, high-traffic sizing, cloud pricing, and today’s free-versus-paid line belong on Matomo’s own pages.
- Privacy posture. It can be configured for tighter collection, including a mode aimed at consent-exempt audience measurement. “Can be configured” is the point. A finished install is not a finished compliance file.
- Do not buy it if you need feature flags inside the product itself, or you will not staff the application and a real privacy configuration.
PostHog: the product platform with a heavy floor
PostHog is the widest bet, which is why teams testing AI automation look at it: an assistant to ship, a copilot to gate, an experiment on whether the agent helps conversion. It is generally described as web analytics and product analytics under one event model, covering feature flags, session replays, experimentation, and a data warehouse. Confirm what the edition you deploy actually includes. The core is open source. PostHog’s self-host documentation says you can host it yourself, and that the free Docker Compose deployment is under an MIT license.
Then the docs get blunt. Self-hosted deployments are “officially unsupported.” PostHog does not manage those instances and does not sell paid support plans for them. You assume all responsibility and risk. PostHog Cloud, with US and EU signup paths, is “far and away the best experience for the vast majority of our users.”
The self-hosted version is the same exact product we run on PostHog Cloud.
The same documentation says cloud infrastructure is “very, very different, ” and that self-hosting comes with no guarantees. PostHog does not publish a public list of known security flaws for self-hosted installs. It does not maintain supported versions, because fixes ship continuously to Cloud and to the latest image. Same product does not mean the same safety net.
- Job. Product analytics around features you are shipping, not just a count of pages.
- What you operate. If you self-host, a Linux Ubuntu virtual machine equivalent to a Hetzner VM with 4 vCPU, 16GB RAM, and more than 30GB storage. The example stack includes ClickHouse and Kafka (a columnar analytics database and a message bus) plus several companion services. That is not a page counter, and a bargain one-or-two-core server is the wrong mental model.
- Privacy posture. You hold the data if you run the stack. You also hold the operational and security risk, with no vendor support plan behind it.
- Do not buy the self-hosted path if you wanted a light tracker, or you need someone else on the hook when it breaks. Use Cloud unless you are prepared to own that floor in writing.
The consent exemption that costs you reports
France’s data-protection authority, CNIL, published a self-assessment tool for consent-exempt audience measurement in July 2025. Matomo’s configuration guide maps a compliance mode to that tool. Enabling it is site-specific or instance-wide. It takes an enforce-all control or the individual toggles, and it disables features Matomo judges incompatible with the exemption. The guide’s self-assessment is Matomo’s, not a regulator’s listing. Do not brief a vendor checklist as a CNIL decision unless you have checked a primary CNIL source yourself.
The practical cost is the part worth remembering. In that mode, Matomo says full user-agent strings are never stored or exported. Device-model detection and screen-resolution reports are unavailable, and browser and operating-system reports show major versions only. Custom goals and events have to stay inside permitted audience-measurement categories. The guide confirms a cap of three event types and constrains what those events may describe. The assessment also does not reflect consent collected through a consent-management platform. Steps Matomo marks as manual, including third-party cookies and the opt-out interface, still sit with you.
That is the trade behind “no banner.” You get a thinner picture, not permission to run heatmaps, session recordings, and rich events on French visitors without consent. Put the same caution next to any cookieless claim. A missing cookie is a technical detail. Whether you may collect the data is a legal question.
Questions worth settling before you migrate
What do you actually gain by self-hosting analytics?
The raw visitor feed can stay on infrastructure you control, retention is your decision, and a third-party analytics vendor does not have to see that feed. You accept hosting, backups, updates, scaling, and the admin time that comes with them.
Does cookieless or self-hosted mean you are GDPR-compliant out of the box?
No. Self-hosting can simplify cross-border processor questions, but you still need a lawful basis. Matomo’s path toward consent-exempt audience measurement for French visitors is a configuration mode aligned with CNIL’s July 2025 criteria, and it turns features off. It is not the default install.
Can a small team run the full platform on a cheap server?
A small team can maintain a light tracker if the tool matches the time on hand. PostHog’s own docs set a floor of 4 vCPU, 16GB RAM, and more than 30GB storage, on a deployment the vendor calls officially unsupported. Do not budget that like a page counter.
Is the self-hosted product the same as the cloud product?
PostHog says the self-hosted version is the same product it runs in Cloud, and also that cloud infrastructure is very different, with no guarantees and no official support. Matomo’s paid plugins and cloud plan are a separate catalog. Confirm what your edition includes, and who answers when it breaks.
Can you trust an “AI Assistants” report in a board pack?
Not on the evidence available. The vendor describes a Matomo report that separates ChatGPT, Claude, Copilot, and other agents from human visits. Method, accuracy, and free versus paid are unspecified. Demand the labeling rules, the known failure cases, and the price. Do not treat the chart as pipeline.
Which tool fits which job?
Ackee if you want minimal page-level stats and you explicitly do not want a user profile. Umami if you want a light, cookieless traffic and event view and will verify any revenue features in its docs. Matomo if you want a mature web suite and will live with the operations plus a careful privacy config. PostHog if you need flags, replays, and experiments, and you will either use Cloud or staff a heavy, unsupported install.
What to decide before the next planning cycle
Agent traffic is already an AI-for-business problem. It shows up as sessions, skewed engagement, and an AI-for-sales question: did that visit produce pipeline, or noise? Start with the job, not the logo. Clean numbers and a short admin list point to Ackee or Umami. A conversion suite points to Matomo, with the consent-exempt mode treated as a configuration that turns reports off, not as a compliant-by-default install. Feature flags and experiments around an in-product assistant point to PostHog Cloud, unless you are ready to own the heavy install with no paid support plan.
Then do the audit in order. Read the license. List the modules that are paid or cloud-only. Name who supports an on-premises instance. For PostHog, the vendor has already said it does not. Match the privacy configuration to the authority that governs your visitors, including CNIL’s July 2025 criteria if French audience measurement without consent is the goal. If an agent report is why you are switching, get the classification rules before that number reaches a board pack.