Fathom Analytics

Fathom Analytics privacy starts with what the script leaves out. Fathom's documentation states that it measures website activity without setting analytics cookies or building a visitor profile across unrelated sites. You get pageviews, referrers, top pages, UTM campaign data and custom events. You do not get user IDs, session replays or cross-site tracking.

That design is why most teams look at Fathom, and why it cannot replace GA4 for funnel or cohort analysis. If your marketing depends on user-level journeys, that gap matters more than the privacy upside.

One warning from Fathom's own docs: page URLs, referrers and campaign parameters can carry personal data your site puts there, such as an email address in a query string. Keep it out of URLs, because Fathom records what you send it.

Fathom does process IP addresses, briefly. Its data documentation explains that the collector builds a SHA-256 visitor signature from the incoming IP, user-agent information, the site identifier and a daily salt that rotates at midnight UTC. The signature lets Fathom count unique visitors for the day without a persistent identifier.

According to the same page, the ordinary analytics event record has no field for the raw IP or raw user-agent. Because the salt changes every day, one day's signature cannot be matched to the next.

Describe this accurately in your records of processing: Fathom uses IP addresses transiently to generate signatures and does not store the raw values. Saying no personal data is processed at all would overstate it.

EU Isolation is Fathom's answer to the transfer question. Fathom's feature page states that EU visitors are processed on European servers, and that the IP address is stripped from the request inside the EU and never reaches its US infrastructure. Collection runs through bunny.net, an EU-based CDN.

Be precise about the scope. The same page says anonymized analytics are stored on Fathom's US infrastructure, so this is not full EU data residency for your dashboard data. What stays in the EU is the personal data, meaning the IP address, before anonymization.

If a contract or public-sector buyer requires every byte of analytics data to be stored in the EU, Fathom does not meet that requirement.

Searches for Fathom certification usually mean SOC 2 or ISO 27001. Fathom's security page does not claim either for Fathom itself. It documents that its database providers hold them: PlanetScale, which hosts the application database, and ClickHouse Cloud, which hosts the analytics database, both have SOC 2 Type II reports, and ClickHouse Cloud is ISO 27001 certified.

The same page lists TLS between visitors and the CDN, encryption at rest and in transit for database data and backups, one-way hashed passwords and HTTPS-only access. Fathom also publishes a data processing agreement and a subprocessor list.

If your vendor review requires the processor's own SOC 2 report, ask Fathom before you buy. Some procurement teams accept subprocessor reports from a small vendor and some do not.

Fathom is a paid subscription with no free plan. Plans are priced by monthly pageviews across all your sites, starting at $15 per month for up to 100,000 pageviews, and Fathom's pricing page lists a 7-day free trial that requires a card. Every plan covers multiple sites, so agencies and multi-site owners pay for traffic rather than per domain.

Custom events count toward the pageview allowance, including events sent through the API. If you plan to track button clicks or form submissions, estimate the event volume before choosing a tier, and confirm current plans on Fathom's pricing page.

Our take: Fathom is one of the easier analytics tools to defend in a GDPR review, because its documentation is specific about which identifiers it creates and where personal data travels. The daily-salted signature and EU Isolation answer the two questions a data protection review asks first.

It is not an automatic consent exemption. Fathom's own ePrivacy guide says its cookieless design is not a universal exemption and asks you to assess your implementation against local rules. Running Fathom without a banner can be defensible, but document that decision instead of assuming it.

Pick Fathom for clean traffic trends with little compliance overhead. Skip it if you need user-level funnels or audience building.