Most small businesses need five numbers: visitors, sources, landing pages, enquiries and what those enquiries became. A cookie-free tool such as Plausible, or a carefully configured GA4, plus Search Console and an enquiry log, answers all five without collecting more than you need.
A small business can measure its website without tracking individuals by combining three things: a lightweight, cookie-free analytics tool for visits and enquiries, Google Search Console for how people find the site, and a CRM or simple enquiry log for what those enquiries became worth. Together they answer the five questions most owners actually ask: how many people came, from where, to which pages, how often they got in touch, and which enquiries turned into business.
Full-suite analytics can do far more, but more is not the goal. Every extra tracking script adds weight, and often another third party, to your pages, and every extra data point about a person is something you may one day have to justify under India's new data protection law. Measure what you will act on, and stop there.
- the date standard Universal Analytics properties stopped processing data
- 1 July 2023
- the date standard Universal Analytics properties stopped processing data
- the longest event data retention a standard GA4 property offers
- 14 months
- the longest event data retention a standard GA4 property offers
- the default expiry of the _ga cookie GA4 uses to tell visitors apart
- 2 years
- the default expiry of the _ga cookie GA4 uses to tell visitors apart
- the maximum DPDP Act penalty for failing to take reasonable security safeguards
- ₹250 crore
- the maximum DPDP Act penalty for failing to take reasonable security safeguards
01
The five questions an owner needs answered
Almost every decision a small business makes about its website or marketing comes back to five questions. None of them requires knowing who a visitor is. A furniture showroom in Kochi, to take a hypothetical case, needs to know that most enquiries arrive from Google Maps and Instagram, not which individual looked at the sofa page three times.
| Question | What to count | Where it comes from |
|---|---|---|
| How many people came? | Visitors and visits per month | Your analytics tool |
| Where did they come from? | Google, social, referrals and campaigns | Analytics, with tagged links for campaigns |
| Which pages did they land on? | Top entry pages | Analytics |
| How often did they get in touch? | Form sends, call taps, WhatsApp taps | Goals or events in your analytics tool |
| What were those enquiries worth? | Leads, quotes and sales by source | Your CRM, or a simple enquiry sheet |
Search Console fills in the one thing your analytics tool cannot see: the Google searches that showed your pages, and how often people clicked through.
02
What 'privacy-first' actually means
Privacy-first analytics tools generally count visits without cookies or persistent identifiers and without storing personal data. Plausible, for example, says it uses no cookies, stores no personal data or IP addresses, and processes its cloud customers' data on infrastructure run by European providers. Cloudflare Web Analytics is free, says it does not collect visitors' personal data, and does not log query strings, which can carry sensitive details.
The trade-off is depth. These tools report totals and trends, not individual journeys, and some are thin on conversions. Cloudflare's own FAQ says custom events are not supported yet, so it cannot count a form send or a WhatsApp tap on its own, and because it does not log query strings, it does not read UTM campaign tags either. Plausible can: you add a class name to a button, or one line of JavaScript, and create a matching goal in its settings.
If you would rather own the data outright, open-source tools can run on your own server. Plausible offers a free, self-hosted Community Edition with fewer features than its paid cloud service, and Matomo and Umami, which says it uses no cookies, are other open-source options worth comparing.
| Option | Cookies and personal data | Counts enquiries? | Cost |
|---|---|---|---|
| Plausible | No cookies; no personal data or IP addresses stored | Yes, through goals and custom events | Paid cloud plans, or a free self-hosted edition |
| Cloudflare Web Analytics | Does not collect visitors' personal data | Not yet: no custom events | Free |
| Google Analytics 4 | Uses cookies; does not store IP addresses | Yes, through events | Free of charge |
03
If you keep Google Analytics, configure it carefully
Google Analytics 4 is free and capable, so switching is not compulsory. It replaced Universal Analytics, whose standard properties stopped processing data on 1 July 2023, and Google said at the time that GA4 does not rely exclusively on cookies and would not store IP addresses.
Google Analytics 4 will also no longer store IP addresses.
GA4 still uses first-party cookies to recognise returning visitors and their sessions, and sets its main cookie to expire after two years by default, though browsers can cut that short. Its settings decide how much it keeps and shares, and three of them keep it proportionate.
- Data retention. Standard properties can keep event-level data for 2 or 14 months. Choose the shorter period unless you genuinely analyse year-old behaviour.
- Consent mode. Google's consent settings, which gained the ad_user_data and ad_personalization signals in November 2023, let you deny advertising storage and ad data sharing while still allowing analytics storage. If you run no Google Ads, deny them.
- Only the events you need. Form sends, call taps, WhatsApp taps and bookings. Measuring everything is how you end up knowing nothing.
04
What India's data protection law changes
The Digital Personal Data Protection Act, which received the President's assent on 11 August 2023, covers personal data in digital form, and it defines personal data as any data about an individual who is identifiable by or in relation to that data. Where it applies, a request for consent must come with a notice, and the consent itself must be 'free, specific, informed, unconditional and unambiguous with a clear affirmative action'. Personal data must also be erased once the person withdraws consent or the purpose is no longer being served, unless a law requires it to be kept. The Act's schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹50 crore for breaching provisions it does not list separately.
The Act comes into force on dates the government notifies. The Ministry of Electronics and Information Technology published draft rules for public consultation in January 2025, but as of September 2025 the final rules had not been notified, so this is preparation rather than a deadline. The direction is clear, though, and analytics that never collects identifiable data is the easiest part of your website to defend. If a tool does identify people, through logins, user IDs or advertising features, plan for a proper notice and consent flow.
05
A setup that takes ten minutes a month
For most small businesses, this is enough:
- A cookie-free analytics tool on every page, with goals for form sends, call taps and WhatsApp taps. Or GA4, configured as above.
- Search Console verified for your domain and checked monthly for the queries and pages that bring people in.
- Tagged campaign links on every ad, email and paid post, so your sources stay readable.
- An enquiry log or CRM that records where each lead came from and whether it became a sale.
- One monthly review: visitors, top sources, top landing pages, enquiries and won business, compared with last month and the same month last year.
What you leave out matters as much. Session recordings, heatmaps and advertising pixels collect far more about individual people than these five questions need, so add one only for a specific job, and remove it when the job is done.
That is three tools and one habit. If you want it set up properly the first time, events included, analytics and conversion tracking are part of our web development work.
Sources
Facts current as of 26 September 2025.