Web tracking tools explained: a strategic look alongside Google Analytics

Shop for a web tracking tool and you will notice something strange: every product calls itself analytics. The tag manager calls itself analytics. The heatmap tool calls itself analytics. The traffic counter calls itself analytics. Yet these tools do completely different jobs, answer different questions, and carry very different privacy obligations. Buying on the label alone means paying for a tool that does not answer your actual question, or stacking five tools on one site and turning your consent banner into a legal document.

This guide sorts the market into four clear categories, shows where the privacy risk sits in each, and then takes a closer look at the category every website needs first: traffic analytics, where cookie-based, privacy-friendly, and privacy-first tools approach the same job in fundamentally different ways.

What web tracking tools do

Web tracking tools help businesses understand website traffic and user behavior: how many people visit, where they come from, which pages perform, where visitors click, and which campaigns convert. Used well, this data lets you optimize campaigns and build user journeys that convert better. Used carelessly, the same tools compromise user privacy and create compliance risk, so it pays to know which category you are actually dealing with.

The four categories of web tracking tools

Traffic analytics: the baseline every site needs

Traffic analytics tools count visits and tell you where they come from: traffic volume, sources, top pages, time on page, aggregated user flows, devices, and locations. Google Analytics is the best-known example, which is also why so many teams search for a Google Analytics alternative without consent banners.

A typical use case: a marketing lead checks every Monday which channels the new landing page attracts visitors from, and adjusts spend accordingly. Without traffic analytics, every other tool in this list operates blind.

The privacy risk depends entirely on the approach. Cookie-based tools require consent banners, while privacy-first tools can measure traffic without processing personal data at all. More on that distinction below.

Behavior tools: heatmaps, scroll maps, and session recordings

Behavior tools show what visitors do once they are on a page. Heatmaps aggregate clicks, scroll maps show how far down the page visitors read, and session recordings replay individual visits like a screen capture.

A typical use case: a pricing page gets plenty of traffic but few signups, and a scroll map reveals that most visitors never reach the comparison table at the bottom. Moving the table up is a quick fix that traffic numbers alone would never have suggested.

The privacy risk inside this category is split. Aggregated click and scroll maps can be built without any personal data. Session recordings, however, are the most privacy-sensitive category on this list: they capture an individual user’s complete behavior and, if not carefully masked, the text people type into forms. Treat recordings like the personal data processing they are.

Worth knowing before you buy a separate product: some analytics tools, mandera included, ship click, scroll, and mouse movement heatmaps built in for every page, with no extra setup and no session recordings.

Tag managers: orchestration, not tracking

A tag manager, such as Google Tag Manager, does not track anything by itself. It is a container that loads, fires, and manages the scripts of other tools, so the marketing team can add a pixel or swap an analytics snippet without filing a developer ticket.

A typical use case: an agency runs campaigns across three ad platforms and uses the tag manager to deploy each platform’s conversion tag without touching the site’s codebase.

The privacy risk is indirect but very real. Tag managers are the gateway through which tracking proliferates: because adding a tag is so easy, sites accumulate pixels nobody remembers installing. The container itself needs no consent, but almost everything it fires does, so it must be wired to respect the user’s consent choice for every tag.

Marketing and ad pixels: conversion tracking for ad platforms

Ad pixels, like the Meta pixel or the Google Ads tag, report conversions back to the ad platform and build remarketing audiences, so platforms can attribute purchases to ads and optimize delivery.

A typical use case: an online shop uses the pixel to tell the ad platform which clicks turned into orders, so the platform can find more buyers like them.

This is the most consent-dependent category. Pixels share behavioral data with third parties for advertising purposes, which under the GDPR requires explicit, informed consent in essentially every case. Firing an ad pixel before the visitor has agreed is one of the most common compliance failures on the web.

The four categories at a glance

Traffic analytics: the three main approaches

Within the baseline category, all tools share a purpose, but the way they approach it makes a big difference, especially when it comes to privacy.

Approach 1: cookie-based tracking

Cookie-based website analytics used to be the primary method of user tracking. Cookies are small pieces of code stored in users’ browsers, collecting information about user behavior in real time. Third-party cookies in particular continue to track data even when users move to other websites, which gives website owners detailed behavior analytics but raises serious privacy concerns.

Since the introduction of the General Data Protection Regulation (GDPR), websites must ask for explicit consent to store non-essential cookies. That means implementing cookie consent banners, which affect the UI and UX.

Approach 2: privacy-friendly tracking

Regulators are not the only ones pushing back. Many users rely on VPNs, ad and cookie blockers, private browsers, and incognito modes to protect their privacy, which makes cookie-based analytics less accurate. And when privacy-conscious users see third-party cookie consent screens, they will likely question the ethical standards of companies using intrusive tracking methods.

For those reasons, privacy friendly analytics tools have started emerging. Instead of using third-party cookies, they rely on different methods, such as:

• IP address anonymization and hashing
• No tracking across websites
• Minimal personal data processing
• No user profiling

While these methods are certainly a step in the right direction regarding privacy, they may still cause compliance risks.

Minimal personal data processing still requires consent

GDPR requires explicit consent for personal data processing, regardless of the amount and form. While privacy-friendly tools try to anonymize personal data, they still sometimes process it on their servers.

One example is IP hashing, which replaces IP addresses with a fixed string of characters. Even though a hashed IP address is hard to break, the act of hashing is considered data processing, as IP addresses are personal data.

Privacy-friendly tools may also rely on fingerprinting, which combines several pieces of information and assigns each user a unique identifier. Combining precise details on location, device, and system into an identifier is regarded as personal data processing, as it can be traced back to an individual user.

Because of this, using privacy-friendly analytics still requires explicit user consent despite avoiding third-party cookies, and processing personal data on your servers carries compliance and reputational risks.

Approach 3: privacy-first web tracking tools

Privacy-first tools take the idea to its logical end: they are designed never to collect personal data at all, which makes cookieless analytics possible without the compliance gray zones described above.

mandera is a privacy-first, agentic website growth system. Its analytics suite measures everything happening on your website without cookies or personal data, and the rest of the system turns that data into growth opportunities, strategies and content. Here is how the tracking side works.

Private by design

Unlike privacy-friendly analytics, which use methods to minimize and anonymize personal data processing, mandera is private by design and does not process any personal data, not even the IP address.

With mandera, there is no hashing, fingerprinting, profiling, or similar attribution methods. The IP address is dropped from every request. mandera only collects aggregated, anonymous signals that cannot be traced back to individual users:

• the page that was opened
• the traffic source, taken from the referrer or from campaign parameters such as utm_source
• the country, derived from the browser timezone, never from an IP address
• the language, from the browser setting
• screen and window size
• engagement, such as time on page, clicks and scroll depth
• the device, browser and operating system, in shortened form

While that information cannot be associated with individual users, it is still precise enough to allow mandera analytics to distinguish individual website visits and show actionable metrics. You can read exactly how this works in our how we track documentation.

Regulatory compliance without consent banners

Because personal data is not processed or stored, mandera is GDPR compliant by design and built to meet modern privacy regulations, all without displaying consent banners.

As a result, your UX remains uninterrupted, allowing website visitors to engage with content without consent pop-ups.

mandera is a German company with servers located in Germany. The data is hosted in Germany, encrypted in transit, and always remains within the EU, in accordance with the GDPR.

Accurate metrics

As a privacy-first web analytics platform, mandera does not rely on cookies to display analytics. There is no personal data processing and no profiling, so VPNs, ad blockers, incognito modes, and private browsers will not interfere with the results. mandera shows accurate analytics while fully respecting users’ privacy.

User flow overview

mandera’s User Flow maps the real paths visitors take through your site, aggregated and anonymous, so you see where people go next and where they leave.

That overview helps you understand how visitors navigate your website once they enter it, so you can spot weak points and make further optimizations.

Simple to set up, optimized for performance, an intuitive dashboard

mandera has a lightweight script that will not slow down your website’s performance, and the installation is ready in minutes. The intuitive dashboard gives you a detailed but easy-to-understand analysis of visitor metrics and engagement patterns, actionable without excessive complexity.

Transparent pricing

mandera is a subscription with a flat fee and generous limits. It does not scale with your traffic, so there are no surprises on the invoice. Traffic spikes are something to look forward to, as more visitors ultimately translate into more leads and conversions.

Beyond analytics

Measuring traffic is where mandera starts, not where it ends. Everything the analytics suite collects flows into mandera’s Agentic Engine, which surfaces growth opportunities from your own data and helps you turn them into strategies and content, while you approve everything that touches your site.

Frequently asked questions

What is the difference between a tag manager and analytics?

An analytics tool collects and reports data about your visitors. A tag manager collects nothing itself: it is a container that loads and manages the scripts of other tools, including analytics. The manager is the plumbing, while analytics is the measurement.

Are heatmaps GDPR compliant?

It depends on the tool. Heatmap products that record full sessions or capture form inputs process personal data and need a legal basis, usually consent. Aggregated click and scroll maps that contain no personal data can run without consent, so check exactly what a tool stores before deploying it.

Which tracking tools does a small website actually need?

Traffic analytics is the only true must-have, because it answers the basic questions about visits, sources, and pages. Add behavior tools when you are optimizing a specific page, and ad pixels only while you run paid campaigns. A tag manager is overkill for a site running a single analytics tool.

Web tracking tools: our conclusion

Web tracking is four different jobs, and the first step is matching the tool category to the question you want answered. For most websites, that starting point is traffic analytics.

Within that category, the strategic choice is about privacy. Cookie-based tools such as Google Analytics used to be the go-to method, and privacy-friendly tools improved on them, but they are still a step away from full compliance, as personal data is still sometimes processed, requiring consent.

Privacy-first tools like mandera allow you to collect website traffic information accurately without processing personal data. Your website will stay compliant, and your visitors will not be interrupted by intrusive consent banners.

Ready to see it on your own traffic? Subscribe to mandera and put the whole system to work on your growth. Your free trial includes 10 high-impact opportunities to get you started.

start free trial

Last updated: 15 June 2026