← Back to Directory
Logo: StatCounter

StatCounter

Irish-hosted web analytics with real-time individual visitor feeds, session replay, heatmaps, and paid-traffic tools—cookie and IP based, not cookieless privacy analytics.

analyticsweb-analyticssession-replayheatmapsirelandgdprcookiesreal-time
Visit WebsiteAsk an EU migration specialistFeedback & corrections

StatCounter is a hosted web analytics service operated by Statcounter Limited from Dublin, Ireland. Website owners add a JavaScript snippet or a platform-specific install so browser visits are reported in real time.

It exists for operators who want per-session visibility rather than aggregate-only privacy analytics. The product is built around a live visitor feed, navigation paths, IP-level location, optional session replay, and higher-tier heatmaps.

The concrete differentiator is that individual-visitor model, including paid-traffic and click-fraud oriented reports. It is cookie and IP based, not a cookieless GDPR-minimal tracker.

Ireland-operated SaaSReal-time visitor feedsSession replay + heatmapsCookie + IP trackingFree Basic tierHosted only

Shortlist when you want Irish-hosted, SMB-friendly analytics with real-time individual visitor feeds, optional session replay/heatmaps, and paid-traffic forensics. Skip when you need cookieless/minimal data collection, self-hosting, or published ISO/SOC and subprocessors—consider Plausible Analytics, Simple Analytics, or Piwik PRO instead.

Key capabilities

Live and recent-activity views show sessions as they happen with location, system stats, referrers, and navigation paths—not only aggregate totals. Magnify drills into a single visit for ops-style investigation. Best for SMBs and agencies that react to traffic in the moment; free Basic caps monthly sessions and short retention.

Optional session replay plays back clicks, taps, scrolling, mouse movement, and form interactions so teams see friction visually. Heatmaps (higher paid tier) show attention and ignored elements. Recording volume is sold as an add-on pack; treat replay as high-sensitivity processing that usually needs clear notice and lawful basis.

Conversion tracking, UTM campaign trends, paid-traffic analysis for repeat IPs, and Google Ads integration that attaches campaign/keyword context to individual sessions. Aimed at marketers defending ad spend and spotting click fraud—not a full marketing automation suite.

Official docs describe an is_unique cookie for first-time vs returning visitors plus collection of IP, browser, OS, device, and page metadata. Project settings can mask the last IP octet when you treat addresses as personal data. This is classic analytics tracking—not a cookieless, consent-light design.

Install guides cover 70+ platforms; paid tiers add CSV export and API access; mobile apps cover on-the-go stats and visitor alerts. Separately, Statcounter Global Stats publishes public browser/OS market-share charts from the tracking network—useful industry context, not a substitute for your site's private reports.

At a glance

HQ
Dublin, Ireland
Legal entity
Statcounter Limited (CRO 431839)
Product since
1999 (company 2006)
Deployment
Hosted SaaS only
Tracking model
Cookies + IP + optional session replay
Commercial model
Free Basic + session-volume paid tiers
Open source
No

Best fit when

  • SMBs, freelancers, and agencies that want simple dashboards plus per-visitor detail without GA complexity
  • Marketers who need session-level paid-traffic and Google Ads context to investigate click patterns
  • Teams that value live visitor feeds, alerts, mobile apps, and human support on paid plans
  • Buyers preferring an independent Irish commercial analytics vendor over US ad-tech defaults
  • Sites already prepared to run classic analytics cookies and document processing in privacy notices

Poor fit when

  • Cookieless or consent-light privacy programmes (CNIL-style minimal analytics)
  • Organisations that require self-hosting or full infrastructure control
  • Procurement that mandates public ISO 27001/SOC 2 and a published subprocessor list before shortlist
  • Use cases that must avoid session recording or individual IP-level visitor inspection
  • Enterprise product analytics needing deep funnel/experimentation stacks beyond SMB web stats

Consider instead when

  • When: You need cookieless, aggregate-only metrics with a lighter ePrivacy consent story

    Consider: Plausible Analytics or Simple Analytics

    Both are EU-hosted privacy-oriented analytics; far less per-visitor forensics than StatCounter.

  • When: You need enterprise privacy packaging, stronger controller tooling, or optional self-host paths

    Consider: Piwik PRO (or self-hosted Matomo-class stacks)

    Heavier setup and product surface; better when DPA/hosting artefacts are mandatory.

  • When: You are deep in Google's marketing stack and need free default reporting at huge scale

    Consider: Google Analytics (with full transfer/risk review)

    US-group processing and steeper UX; stronger ecosystem integrations.

Jurisdiction & ownership

Legal entity
Statcounter Limited (Dublin; VAT IE 9582511F)
Governing law
Republic of Ireland (venue Dublin)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Unknown
Hosting / residency
Vendor describes visitor data as stored on StatCounter servers; no public subprocessor list or named cloud regions (AWS/GCP/Azure etc.) found on primary pages at research time. Marketing site monetization references Snigel—not a documented analytics data-path subprocessor list.

Irish entity and Irish governing law with no disclosed US parent. CLOUD Act exposure left unknown because hosting providers, backup regions, and subprocessors are not published—do not assume EU-only infrastructure. Indicative only, not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionPartial
  • +3

Considerations & known limitations

  • HighClassic cookies + IP + visitor-level detail

    Not cookieless privacy analytics. is_unique cookies, IPs, and per-visitor forensics increase ePrivacy/GDPR programme burden versus aggregate-only EU tools.

  • HighSession replay captures rich interactions

    Official replay guide includes clicks, scrolling, and form interactions. Usually needs explicit notice/consent and careful redaction policies for sensitive fields.

  • MediumTerms claim joint ownership of visitor data

    Legal terms state both the site owner and StatCounter own collected visitor data—review implications for controller/processor roles and secondary use.

  • MediumNo public subprocessor / region list

    Hosting described only as vendor servers. Without named providers/regions, transfer and CLOUD Act diligence stays incomplete.

  • MediumNo public ISO/SOC/independent audit

    Enterprise security questionnaires will lack downloadable certs/audit reports from the public site.

  • MediumVendor IP personal-data interpretation is contested

    GDPR FAQ leans on older Irish case law; many EU programmes still treat IPs/cookie IDs as personal data. Use IP masking and counsel review where needed.

Open questions for due diligence

  • Will StatCounter sign a GDPR DPA and name all subprocessors and hosting regions in writing?
  • Where exactly is customer analytics data stored and backed up (country and provider)?
  • What field-redaction / exclusion controls exist for session replay on password and payment forms?
  • Is there any ISO 27001, SOC 2, or independent penetration-test summary available under NDA?
  • How should controllers interpret joint ownership wording in the terms relative to controller/processor roles?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

No. Primary legal and GDPR materials describe cookies (including is_unique for returning visitors) and collection of IP address, browser/OS, device data, referrers, and page URLs. Session replay can record on-page interactions including forms. That differs from cookieless EU tools such as Plausible or Simple Analytics. Site owners typically need appropriate notices/consent under ePrivacy/GDPR for non-essential cookies and recording; StatCounter provides template privacy-policy wording and a cookie-refusal link, but compliance remains the controller's duty.

StatCounter's GDPR FAQ argues IPs may not be personal data for a typical webmaster who cannot identify the person, citing older Irish High Court reasoning, while also acknowledging GDPR language that online identifiers may be personal data. Controllers who treat IPs as personal data can enable IP masking (last-octet redaction) in project settings. Treat the FAQ as vendor guidance—not legal advice—and have counsel review your lawful basis, retention, and processor contracts.

StatCounter is hosted SaaS only—no official self-hosted product was found. At research time there was no public subprocessor list, no ISO 27001/SOC 2 pack on the marketing site, and no clearly published standard B2B DPA download. Ask sales/support for a DPA, hosting regions, and subprocessors before regulated or public-sector use; prefer Piwik PRO or self-hosted stacks when those artefacts are mandatory.

A free Basic plan with limited monthly sessions and short retention; Premium and Premium Plus tiers that scale by monthly session volume and unlock conversion tools, exports, API, longer retention, heatmaps, and Ads/UTM features; optional session-replay recording packs; and a 30-day trial of paid features without a card. Confirm current quotas on the official pricing page—figures change and should not be copied into long-lived docs.

Choose Plausible or Simple Analytics when you want aggregate, cookieless metrics and a lighter consent story. Choose Piwik PRO (or self-host analytics) when you need stronger enterprise privacy packaging, contractual clarity, or infrastructure control. Keep StatCounter when individual-visitor forensics, session replay, and SMB-oriented paid-traffic tooling on Irish-operated SaaS matter more than minimal data collection.