Privacy-focused cookie-free website analytics tool

Yes. I’d narrow the field to Umami, Plausible, Fathom, and Matomo configured for cookieless tracking. The important distinction is that “cookieless” does not necessarily mean “no identifiers whatsoever”—some tools use short-lived/hashed identifiers to calculate unique visitors.businessmcp.com+1

Platform	Cookieless	Custom events	Funnels	Campaign attribution	Raw personal identifiers
Umami	✅	✅	✅	✅	Designed not to collect personal data
Plausible Analytics	✅	✅	✅*	UTM/source attribution	No PII; uses privacy-preserving visitor counting
Fathom Analytics	✅

*Plausible's funnel functionality depends on the plan.

The closest match: Umami

Umami appears to be the strongest match for your exact requirements. Its current documentation explicitly lists funnels, custom events, attribution, campaign analysis, custom event properties, and revenue attribution, while stating that it operates without cookies and without collecting personal data.umami.is

That means you can do things such as:

Google/LinkedIn campaign → landing page → signup event → checkout event

without needing a conventional persistent user ID.

It also supports self-hosting, which gives you additional control over what is retained and where.umami.is+1

Plausible

Plausible is a good fit if you want a lighter-weight marketing analytics product. It supports custom events and campaign/UTM attribution, and its cookieless approach avoids collecting conventional personal identifiers. Its limitation is depth: it isn't intended to reproduce the user-level behavioral analysis of GA4/Mixpanel.businessmcp.com

Fathom

Fathom is another straightforward cookieless option. It supports goals/events and campaign/source reporting, while deliberately avoiding persistent user tracking. It's consequently better suited to website/conversion analytics than detailed product analytics.businessmcp.com+1

Matomo

Matomo is the interesting choice if you need more sophisticated analytics. It can operate without cookies and offers custom reports, funnels, segmentation and attribution capabilities. However, unlike the privacy-first products above, cookieless operation is a configuration choice, so you'd need to implement and audit the privacy settings carefully.businessmcp.com+1

One important caveat

If by “without collecting raw personal identifiers” you mean literally no IP address, user-agent-derived identifier, fingerprint, persistent visitor ID, email address, etc. entering the analytics system, I'd distinguish that from merely saying “cookieless.”

For example, some cookieless systems still derive an anonymous/rotating visitor identifier from request information so they can calculate unique visitors.businessmcp.com+1

So I'd categorize them this way:

• Need funnels + events + campaign attribution + privacy: Umami
• Mostly marketing/site analytics, very simple: Plausible or Fathom
• Need advanced analytics/attribution and are willing to configure privacy carefully: Matomo
• Need absolutely no visitor-level identifier at all: look specifically for an aggregate-only design rather than simply searching for “cookieless.”

If you tell me whether this is for a marketing site, SaaS product, or e-commerce site, I can also compare these four on exactly what data they send/store, attribution methodology, self-hosting, retention, and GDPR/CCPA implications.

Privacy-focused analytics platforms have moved away from persistent tracking (like cookies, local storage, or long-term browser fingerprinting). However, they differ significantly in how they calculate visitor numbers and sessions without them.plausible.io

The two main transparency models used by leading cookieless platforms clarify how they count traffic without compromising user privacy:

1. The Hashing/Daily-Rotating Salt Model (e.g., Plausible & Fathom)

These platforms do not write anything to the browser, but they do temporarily process transient connection data (IP address and User-Agent) on the server side to calculate a unique signature.usefathom.com+2

• How Session/Visitor Counting Works:
  • They generate a temporary cryptographic hash using a combination of the visitor's IP address, User-Agent, domain name, and a daily-rotating random salt (a random string of data that changes and deletes every 24 hours at midnight UTC).
  • Hash = SHA256(daily_salt + domain + IP + User-Agent)
  • Raw IP addresses and User-Agents are never stored in a database.usefathom.com+1
• Attribution & Session Definition:
  • Because the hash resets every 24 hours, a person visiting on Monday and returning Tuesday is counted as two unique daily visitors.
  • A session/visit is typically defined as a continuous block of activity ending after 30 minutes of complete inactivity. Within that single day, multiple visits from the same hashed signature are grouped or tallied as separate sessions if separated by the inactivity timeout.plausible.io+2
• Where to read their exact explanation:
  • Read the technical breakdown directly in the Plausible Data Policy.
  • Check the methodology notes on Fathom Analytics Measurement Docs.plausible.io+1

2. The Strict Referrer-Based Model (e.g., Simple Analytics)

This approach goes a step further than daily hashing by completely refusing to derive any visitor identifier or hash from IP addresses or user agents.docs.simpleanalytics.com+1

• How Session/Visitor Counting Works:
  • They do not track individual people or try to stitch together unique humans over a 24-hour period . Instead, they measure unique pageviews (which they label as "visitors" in the dashboard).
  • A pageview is counted as a "unique visitor" purely based on the HTTP Referrer header:
    • Counted as unique: If there is no referrer (direct traffic) or if the referrer hostname does not match your own website's domain (external traffic source).
    • Not counted as unique (internal navigation): If the referrer hostname already matches your own website, or if it's an internal click, page reload, or browser back/forward action.simpleanalytics.com+2
• Attribution & Session Definition:
  • Traffic sources and attribution are derived strictly from incoming UTM parameters and external HTTP referrer URLs attached to the initial entry event. There is no persistent session tracking across internal page clicks—each internal movement is just mapped as an aggregate event tied to that initial referral source.docs.simpleanalytics.com+1

If you are trying to choose between these models for a specific project, let me know:

• Do you need precise daily unique visitor counts (which requires the daily-hash approach like Plausible/Fathom)?
• Or do you need zero IP-derived data whatsoever for strict regulatory compliance (which points to Simple Analytics)?