The best web analytics tool: the 12 requirements that actually decide it

Every kilobyte of measurement code is a tax on the sessions you most want to measure. A 171 KB tag on a 3G connection in a regional market doesn’t arrive late — it often doesn’t arrive at all, because the visitor has already bounced. You lose the slowest, most mobile, most marginal traffic first, which is exactly the traffic where your conversion rate is most fragile. And the data loss is invisible: the sessions that never fired don’t appear in the report telling you sessions are down.

Then there is the second cost. Measurement code that competes with your own JavaScript for the main thread degrades LCP and INP, and Core Web Vitals is not a vanity metric on an eCommerce site — it moves rankings and it moves conversion rate. You are paying for measurement twice: once in lost data, once in lost revenue.

Under 5 KB gzipped on the wire, under 10 KB of JavaScript parsed on the device, asynchronous, non-blocking, no dependency on a tag manager to function. Adobe’s Launch plus AppMeasurement lands in the same range as GA4. We measured every major analytics script to check. A platform that needs 100× more code than the alternative is making a design choice, not meeting a technical necessity.

This is the requirement that invalidates every other one. A platform that gives you forty percent of reality with perfect dashboards is worse than a spreadsheet with all of it, because it gives you the confidence to act on a sample that isn’t random.

Three separate leaks compound. Consent: in European markets, rejection rates of up to 60% are normal once a compliant banner is in place, and rejected visitors are not measured at all by consent-dependent tools. Ad blockers and browser tracking protection: roughly 25% of technical audiences, higher in some verticals. Tag failure: around 5% on mobile, and it grows on slow networks. Multiply the survivors and you are reporting on a fraction — while your CFO reads it as the whole. It is the arithmetic behind GA4 showing 13% of EU traffic.

The distortion is not evenly spread, which is what makes it dangerous. Privacy-aware audiences skew towards specific channels and specific devices. Organic search is systematically underreported. Paid is systematically flattered, because paid landings carry the parameters that survive. Every budget reallocation made on that data moves money in the direction of the measurement bias.

The platform must observe 100% of page loads without depending on the visitor accepting anything, and without being classified as a tracker by blocklists. That is only achievable if it stores no personal data — because if it did, consent would be legally required and you would be back at 40%. Completeness and privacy are the same requirement stated twice, not a trade-off, which is the whole argument for cookieless analytics.

Almost every platform ships something called “Realtime”. Almost none of them means what you need. What you usually get is a stripped-down live view — active users, top pages, maybe a country map — while every report you would actually use to make a decision runs on data that is 4 to 24 hours old.

That distinction costs money on exactly the days it matters most. A broken checkout on Black Friday, a tracking parameter dropped in a campaign migration, a landing page 404ing after a deploy: the window to fix each of these is measured in hours, and a platform that shows you the damage tomorrow morning has converted an incident into a loss.

Sub-minute ingestion latency, and — the part that gets skipped — the same freshness across the full report set. Every dimension, every filter, every funnel, every segment queryable on today’s data, at peak load, not just the three metrics on the live tile. Real time that degrades under traffic is not real time; it is real time until you need it.

This is where most platforms quietly fail, and they fail on the third question, never the first.

First question: how did revenue do last week? Every tool answers. Second question: split it by channel. Most tools answer. Third question: within paid social, for mobile users, on the product pages of one specific category, comparing the visitors who saw the size guide against those who didn’t. And now you are exporting to a spreadsheet — which means your analytics platform is a reporting layer with an export button, and the actual analysis happens somewhere it can’t be governed, shared or reproduced.

The technical causes are always the same: pre-aggregated data models that only support the combinations someone anticipated, cardinality limits that bucket your long tail into “(other)”, sampling above a row threshold, and a fixed schema that can’t carry your business’s own dimensions.

Arbitrary dimension × metric combinations with no pre-aggregation ceiling. No cardinality collapse into “(other)”. No sampling, ever — approximation is acceptable in a research tool and unacceptable in a system that signs off on budget. Custom properties as first-class dimensions, not tacked-on labels. Funnels definable after the fact, over historical data, without having been declared in advance. And access to full-resolution rows, so an analyst who needs to leave the UI can, without leaving the platform.

Standard eCommerce events cover the part of your business that looks like every other business. The measurement that actually differentiates you is always custom: the configurator step, the availability check, the finance calculator, the B2B quote request, the phone call that closes offline three days later. If the platform can only measure what it anticipated, your instrumentation ceiling is set by the vendor’s product roadmap.

Arbitrary custom events with arbitrary properties. Micro-conversions as a native concept, not a hack on top of pageviews. Values in currency attached to any event. Client-side and server-side ingestion through a documented HTTP endpoint, so the events that happen off the browser — a webhook, a CRM status change, a call-tracking result — land in the same dataset as the pageviews. Native handling of single-page applications and virtual pageviews. Multi-domain and subdomain measurement without breaking attribution. And rules for classifying traffic into your channels that you can edit yourself, because every business’s definition of “affiliate” or “partner” differs and a fixed channel grouping guarantees you will disagree with your own reports.

An analytics platform whose data can only be read through its own UI is a silo, and silos always end the same way: someone rebuilds the important numbers by hand in a slide, they diverge from the source, and the QBR becomes an argument about whose figure is right.

Every report available in the UI must be reachable via API — no privileged screens. Documented authentication with scoped, revocable keys. Published rate limits, so you can engineer against them instead of discovering them in production. Pagination that works on real volumes. Endpoints that return full-resolution rows, not just aggregates. Webhooks for event-driven operations, so a conversion anomaly can trigger something rather than waiting to be noticed. And native export into a warehouse — BigQuery, Snowflake or equivalent — without you writing and maintaining an ETL job.

One non-negotiable: the API and the UI must return the same numbers. It sounds obvious. Test it anyway, because pre-aggregation differences between the reporting layer and the export layer are a common and extremely expensive surprise.

The way analytical work gets done changed in the last two years, and most platforms have not noticed. Analysts and marketers now work with AI assistants in the loop. If your platform can’t be queried by one, every question becomes a manual round trip: open the UI, build the report, export the CSV, paste it into a chat, ask, get an answer about a stale snapshot with no ability to drill down. That workflow is not just slow. It is unauditable — the model answers on whatever fragment was pasted, and nobody can reproduce it.

A Model Context Protocol server, hosted by the vendor, that exposes the platform’s data as tools an agent can call directly. This is a specific thing, and it is worth being precise, because “AI-ready” is currently the most abused phrase in analytics marketing. An MCP server means: your assistant — Claude, ChatGPT, Cursor, an internal copilot — connects once and can then pull channels, campaigns, funnels, conversions and custom properties itself, live, and follow up without a human re-exporting anything. That is the difference between an assistant and genuine self-service analytics.

Two failures, opposite in kind. The first is the black box: a platform tells you a channel is underperforming, can’t show you the query behind it, and you are asked to move budget on the word of a model. The second is the privacy leak: to give you that insight, your commercial data was sent to a third-party API in another jurisdiction, which is a transfer you may not have disclosed in your record of processing.

AI that does the work analysts don’t have time for — anomaly detection across every dimension continuously, forecasting, surfacing the segments that moved — and that always shows the underlying query, so any claim can be verified in the UI by a human. Plus a deployment choice: either bring your own key, so inference runs against a provider you already have a DPA with, or a vendor-hosted model within your own jurisdiction. For an EU company, “EU-hosted inference” means the model runs in the EU, and it is a separate question from where your analytics data is stored. Ask both.

Attribution is where analytics vendors are least honest, and buyers rarely push. Platforms that model, estimate or fill gaps in conversion data produce numbers that look complete and are partly synthetic. When those numbers disagree with your CRM — and they will — you cannot tell which part was observed and which part was inferred, so you cannot debug the discrepancy at all.

The attribution model must be stated plainly, applied consistently, and documented. If it is last-click, it should say last-click. If conversions are modelled, the platform must label which ones and disclose the method. What no platform should do is quietly blend observed and estimated data in the same figure.

Bot traffic has grown sharply with AI crawlers, and it does not distribute evenly — it concentrates on specific pages and specific sources, which means it doesn’t inflate your totals harmlessly, it corrupts particular rows. Uncounted, it inflates a channel’s sessions, deflates its conversion rate, and you optimise against noise.

Automatic exclusion from reported metrics, and — this is the part usually missing — visibility into what was excluded and why. Filtering you can’t inspect is indistinguishable from filtering that isn’t happening.

The compliance risk in analytics is rarely a fine. It is the six-week delay while legal reviews a transfer impact assessment, the consent banner that costs you 60% of your data to satisfy a requirement the architecture created, and the migration you have to run again in two years when the legal ground moves.

No personal data collected, no cookies, no device fingerprinting, no client-side storage. This is not a stricter version of compliance — it is a different mechanism. A platform that processes no personal data is largely outside the material scope of the rules, rather than compliant within them, and that difference is what removes the consent banner and with it the 60% loss.

Then the operational layer: data hosted in your jurisdiction with the specific location named, a DPA included in the standard contract rather than negotiated, no transfers requiring supplementary measures, and documentation your DPO can read without a call.

Be equally sceptical in the other direction: check certification claims. ISO 27001 and SOC 2 are audited states with certificates and dates. “Aligned with” is not certified. Ask for the certificate.

Two slow failures. Lock-in: you discover at renewal that your three years of history cannot leave the platform in usable form, and the negotiation is over before it starts. And billing surprise: consumption pricing on events means your best month generates your worst invoice, and teams respond rationally by instrumenting less — which quietly caps the value of the whole system.

Full historical export in an open format, on demand, without a support ticket. Stated retention, with a stated policy on what happens at contract end. Pricing tied to a metric you control and can forecast. And a setup cost measured in minutes, because a platform that requires a six-week implementation has already made switching away from it expensive — which is a business model, not an architecture.