Why your old setup is now a liability
Chrome's third-party cookie deprecation completed in 2025. The ICO is enforcing more aggressively. Apple's Mail Privacy Protection and Safari's ITP have stripped accuracy from email and web analytics for years. The data you have been making decisions on is increasingly fictional — and with the new ICO fines, holding it is a risk.
First-party, server-side, consented
The 2026 stack rests on three principles. First-party only: data lives in your domain, not Google's. Server-side: events fire from your server (or Cloudflare edge), not the browser. Consent-aware: nothing fires without explicit permission. These three changes alone restore most of the accuracy you lost.
The recommended UK stack
- Plausible Analytics or Fathom — privacy-friendly page-view analytics, no cookies, GDPR-clean by default, £8–£20/month
- Google Tag Manager Server Container — server-side tagging, runs on your subdomain, restores accuracy without compromising privacy
- PostHog — product analytics for SaaS and apps, self-hostable in the UK if you need full data sovereignty
- Custom CDP — for businesses serious about retention, a tool like Segment with self-hosted Snowplow gives you ownership of your event stream
What you lose, what you gain
You lose: cross-site behavioural targeting, granular individual-user histories, a lot of the "magic" Facebook and Google Ads used to do for you automatically. You gain: regulatory clarity, customer trust, more accurate aggregate data and a stack that will not be obsolete in 18 months.
Migration in 30 days
Week 1: install Plausible alongside GA4. Compare. Week 2: set up server-side GTM. Week 3: rebuild your top five conversion events through the server container. Week 4: kill GA4, kill Hotjar, archive cookie banner pop-ups, replace with a single one-click consent prompt that genuinely works.
Conversion API: still your friend
Meta CAPI, Google Enhanced Conversions and TikTok Events API all let you send conversion data server-side with consent. Your ad performance recovers most of what you thought you lost — without putting third-party trackers on your visitors.
Key Takeaway
Privacy-first analytics is no longer a brave choice — it is the default for UK businesses that want to keep their data clean, their fines at zero and their customers comfortable. The migration takes a month and pays back forever.