Google Analytics alternative: cookieless analytics your AI agent sets up

Q: Does GA4 use cookies?

Yes. Google's tag sets _ga, used to distinguish users, and _ga_ , used to persist session state, each for 2 years by default. With Consent Mode and analytics_storage denied it doesn't read or write analytics cookies. AgentFirstStack's tracker sets no cookies by default.

Q: Can an AI agent set up Google Analytics by itself?

Partly. With Google OAuth credentials and the analytics.edit scope, the Admin API can create a property, a web data stream and key events. Creating the account returns a ticket whose Terms of Service a person accepts in a browser, and Google's own MCP server is read-only. The tag and consent setup still go into the site's code.

Google Analytics 4 is free; Analytics 360 is sold under a contract at a price Google doesn't publish (as of 7 November 2026). GA4 takes a property, a web data stream, the Google tag on every page and, where the law asks for consent, a banner wired to Consent Mode: the tag sets _ga cookies for 2 years. AgentFirstStack Analytics is free, open-source and cookieless; an AI agent sets it up alone, tests it and brings GA4's history over. Stay with GA4 for Google Ads audiences, BigQuery export, app streams, long aggregated history or a team trained on it.

Updated 7 November 2026

Set it up with one prompt

Paste this into your coding agent. It leaves GA4 running, brings its history over and checks our numbers against GA4's before anything is removed.

Paste this into Claude Code, Cursor or Codex

Add AgentFirstStack Analytics to this project next to Google Analytics, and bring GA4's history over. It's free, open-source, cookieless analytics built for agents, and you can do the setup yourself: there is no signup form. 1. Read https://agentfirststack.com/llms.txt (especially "Move from another tool") and https://analytics.agentfirststack.com/llms.txt. 2. If this project's .env already has AGENTFIRSTSTACK_API_KEY, use it and read AGENTFIRSTSTACK.md. Otherwise get a key: curl -X POST https://agentfirststack.com/v1/signup, and save api_key in .env as AGENTFIRSTSTACK_API_KEY and in the production secrets. 3. Find how GA4 is installed (gtag.js, Google Tag Manager, a CMS field or a plugin). Write down the measurement id (G-...), every event it sends and which of them are key events. Don't remove or change any of it. 4. Create a site for the production domain and serve it from our own domain: a first-party domain on a new subdomain with a neutral name such as edge (POST https://agentfirststack.com/v1/first-party-domains), with its CNAME added if you can change our DNS; until then, or if you can't, the path proxy from the install answer. Put the snippet in the head of every page, next to GA4. 5. Create a goal for each GA4 key event and each main action on the site, using GA4's event names. 6. Bring GA4's history over. If you have Google's GA4 MCP server or Data API credentials, run one runReport per breakdown (date alone, then date with pagePath, sessionSource, country and deviceCategory), with "limit": 50000, and send each answer as it came to POST /v1/sites/:id/imports with source "ga4". Otherwise tell me exactly which reports to export as CSV and where to save them. Include GA4's daily visitors up to today. 7. Deploy (or tell me what to deploy), open the site with ?afsa_debug=1, run verify, then GET https://agentfirststack.com/v1/setup?services=analytics until it says ready. 8. Run GET /v1/sites/:id/imports/compare?source=ga4 and tell me what it says. It needs 3 full days with both tools, so tell me how to run it again later. 9. Write the site id, the goals and the env var name (never the key) in AGENTFIRSTSTACK.md, and create a claim link for me with POST https://agentfirststack.com/v1/claim-link. Tell me what you set up, what you imported, what compare returned, and give me the claim link. Leave GA4 installed until I say otherwise.

What Google Analytics 4 is

GA4 is Google's web and app analytics. Google describes it as tools "free of charge" (Google Marketing Platform, as of 7 Nov 2026). Analytics 360 raises the limits; upgrading a property needs "a 360 contract", bought from Google or through a Google sales partner, and Google publishes no price (Google Analytics 360, as of 7 Nov 2026). Their limits, from that page unless noted:

	GA4 (standard)	Analytics 360
Price	Free	A 360 contract; no published price
Key events	30	50
Event-scoped custom dimensions	50 per property	125 per property
Data retention	2 or 14 months	Up to 50 months
Exploration sampling	Past 10M events per query	Past 1B events per query
Data API quota	200,000 tokens a day per property	2M tokens a day
BigQuery daily export	1M events	Billions of events
Daily data ready in, for a normal-size property (data freshness)	12 hours; intraday 2-6 hours	12 hours; intraday about 1 hour
Service level agreement	Not covered	GA 360 SLAs

What GA4 does well is the rest of Google: Google Ads, Search Ads 360, Display & Video 360, Search Console and BigQuery link to it, and the same property can measure web and app data streams.

Cookies and consent

Google's tag sets two first-party cookies: _ga, "Used to distinguish users", and _ga_<container-id>, "Used to persist session state", each for 2 years by default (GA4 cookie usage, as of 7 Nov 2026). Where visitors have to agree to that first, Consent Mode tells the tag what they chose. In the basic implementation, "Google tags blocked until consent is granted"; in the advanced one the tags load first and "send cookieless pings when cookie consent declined", and with analytics_storage denied GA4 "Will not read or write first-party analytics cookies" (Consent mode, as of 7 Nov 2026).

Google fills the gap with behavioral modeling, but only for a property that "collects at least 1,000 events per day with analytics_storage='denied'" for at least 7 days, and has at least 1,000 daily users who granted it on 7 of the previous 28 days (Behavioral modeling, as of 7 Nov 2026). A smaller site gets no modeled data for the visitors who decline.

Data retention, sampling and thresholds

Retention: event data can be kept 2 or 14 months on standard properties (26, 38 or 50 months on 360), and age, gender and interest data always 2 months. But "The data retention setting only affects explorations and funnel reports"; standard aggregated reports keep their history (Data retention, as of 7 Nov 2026).
Sampling: the event-level quota is "10 million events for standard Google Analytics properties" per query, up to 1 billion on 360; past it, results are sampled and the data quality icon shows the share used (Data sampling, as of 7 Nov 2026).
Thresholds: "Data thresholds are system defined. You can't adjust them." Data can be withheld when a report includes demographic data, and a search query row when too few users are behind it (Data thresholds, as of 7 Nov 2026).

The setup work

Google's own steps for a website (Set up Analytics for a website, as of 7 Nov 2026):

Create an Analytics account, and for a new account accept the Analytics Terms of Service and the Data Processing Amendment.
Create a property: a name, the reporting time zone and currency, the industry and business size.
Add a web data stream with the site's URL; enhanced measurement collects pageviews and some events.
Add the Google tag: the G- ID in a CMS field, the gtag.js snippet "immediately after the <head>" on each page, or a tag in Google Tag Manager.
Wait: "Data collection may take up to 30 minutes to begin." Then check the Realtime report.

Then the site's own work: marking key events, sending custom events from the code, and wiring a consent banner to Consent Mode where it's needed.

What an agent can do with Google's APIs

A lot, once a person has set it up. With Google OAuth credentials and the analytics.edit scope, the Admin API can create a property (properties.create), a web data stream whose answer carries the measurement ID (dataStreams) and key events (keyEvents.create). The account is the step it can't finish: provisionAccountTicket "Requests a ticket for creating an account", and the account exists once someone accepts the Terms of Service at that ticket's link. Reading goes through the Data API's runReport, within 200,000 tokens a day and 40,000 an hour per standard property (Data API quotas).

Google's own MCP server is read-only: it "can't create, modify, or delete" the configuration (Google Analytics MCP, as of 7 Nov 2026). Our Google Analytics MCP comparison covers what it needs and returns. For server-side events GA4 has the Measurement Protocol, whose stated intent is "to augment automatic collection", not replace it: it needs the tag on the page too (Measurement Protocol).

How AgentFirstStack does it

There's no account to create first and no Google Cloud project. The agent does every step over REST or MCP with one key, and each step has a check it runs itself:

curl -s -X POST https://agentfirststack.com/v1/signup     # -> api_key: one request, no email
H="Authorization: Bearer $AGENTFIRSTSTACK_API_KEY"; J="content-type: application/json"
A=https://analytics.agentfirststack.com
curl -s -X POST $A/v1/sites -H "$H" -H "$J" -d '{"domain":"example.com"}'
# -> site id and install code; then serve it from the site's own domain (one CNAME):
curl -s -X POST https://agentfirststack.com/v1/first-party-domains -H "$H" -H "$J" \
  -d '{"hostname":"edge.example.com"}'
curl -s -X POST $A/v1/sites/$SITE/goals -H "$H" -H "$J" \
  -d '{"name":"Signup","type":"event","match":"sign_up"}'
curl -s -X POST $A/v1/sites/$SITE/verify -H "$H"          # checks the live page, lists fixes
curl -s https://agentfirststack.com/v1/setup -H "$H"      # "ready": true, or what's missing

No cookies by default. A visitor is a hash of a daily salt, the site, the IP address and the user agent; the salt rotates daily and nothing is stored on the device. The catch: anonymous visitors can't be followed across days, so returning visitors and multi-day attribution need a user_id from your server or the opt-in persistent mode.
Consent where you need it. The tracker can wait for consent (data-require-consent). If the site needs a banner for ad pixels, our tag manager's banner drives Google Consent Mode v2 for any Google tags you keep and keeps a record of each choice; in cookieless mode it doesn't hold back analytics, which stores nothing. Whether a site needs consent for analytics is a question for the law that applies to it.
No sampling or thresholds on counts. Reports read the stored events. The few that cap their input say so: attribution reads the latest 5,000 conversions and answers sampled: true when it hits that.
Live numbers. Realtime reaches a WebSocket stream within a second of each event, and every report reads events as they arrive.
Server events that stand alone. POST /v1/sites/:id/events joins a backend event to the visitor's visit, or records it with visit: false when there's no visit, such as a sign-up over the API.
Beyond pageviews: revenue and MRR from Stripe, Polar, Paddle and LemonSqueezy joined to the visit that brought them, AI crawlers and AI assistant visits, Core Web Vitals from real visitors, funnels, journeys, retention and six attribution models. More on the web analytics page.

The default snippet loads from analytics.agentfirststack.com, which ad blockers block, so the agent serves it from the site's own domain: a first-party domain (one CNAME, no server code) or a path proxy.

Side by side

	Google Analytics 4	AgentFirstStack Analytics
Price	Free; Analytics 360 under a contract, price not published	Free hosted service with fair-use limits; self-hostable
Getting started	An Analytics account (Terms of Service), a property, a web data stream, the Google tag on every page	`POST /v1/signup`, a site, the snippet; your agent does all of it
Agent access	Admin and Data APIs with Google OAuth; `analytics.edit` to change settings; Google's MCP server reads only	REST and MCP on one key, reads and writes
Cookies	`_ga` and `_ga_<container-id>`, 2 years	None by default; persistent mode (opt-in) keeps an id in localStorage
Consent	Consent Mode, basic or advanced; modeling needs 1,000 declined events and 1,000 consenting users a day	Nothing stored on the device by default; `data-require-consent` to wait; our tag manager's banner for Consent Mode v2
Retention	Explorations and funnels 2 or 14 months (up to 50 on 360); aggregated reports unaffected	Raw events up to 400 days hosted; imported history as daily totals
Sampling and thresholds	Explorations sampled past 10M events per query; thresholds on demographic and search query data	None on counts; attribution capped at the latest 5,000 conversions, flagged
Freshness	Realtime in a few minutes; daily data in 12 hours	Realtime within a second; reports read events as they arrive
Server events	Measurement Protocol, alongside the tag	Events API, joined to a visit or standing alone
Integrations	Google Ads, Search Ads 360, Display & Video 360, Search Console, BigQuery	None of those; raw export, read-only SQL, webhooks, Slack and email
Apps	Web and app data streams	Websites and backends; no mobile SDK
Source	Google's hosted service	AGPL-3.0; the tracker MIT

When to choose which

Stay with Google Analytics 4 if

You buy Google Ads and use GA4 audiences, conversions or its links to Search Ads 360 and Display & Video 360.
You export raw events to BigQuery.
You measure iOS or Android apps in the same property.
You need aggregated history longer than 400 days, or a 360 contract with an SLA.
Your team, agency or clients work in GA4 every day.

Use AgentFirstStack if

An agent should set up analytics from nothing and keep it working, without a person creating accounts, properties or credentials.
You want analytics that sets no cookies by default and stores nothing on the device.
You want revenue and MRR by channel, AI crawler and AI assistant reports, and Core Web Vitals in the same place.
You want it open source, free on the hosted service, or self-hosted on your own Cloudflare account.

You don't have to pick one today. Run both: our tag manager sends conversions to GA4 too (the browser tag and the Measurement Protocol), so GA4 keeps what Google Ads needs while your agent runs the rest.

Moving from GA4

Keep GA4 installed. Nothing below removes it.
Goals with GA4's names. Your agent finds the events in the code (gtag('event', ...)) or GTM, and creates a goal for each key event with the same name, so old and new reports line up.
History as daily totals. A Data API runReport response, which is also what Google's MCP server's run_report returns, goes to POST /v1/sites/:id/imports as it came: dimension date plus at most one of pagePath, landingPage, sessionSource, country or deviceCategory, and metrics activeUsers, sessions, screenPageViews, bounceRate and averageSessionDuration. A report exported as CSV with Date added works the same way. A report that holds only its first page of rows is refused, so the agent runs it with a higher limit or a shorter range.
What doesn't come over: event and key event counts, user-level data, audiences, explorations and every dimension beyond those four breakdowns. Imported days count in reports with imported=true only before our first live event, and filtered reports leave them out.
Check the numbers. Import GA4's daily visitors for the days since our tracker went live too. GET /v1/sites/:id/imports/compare?source=ga4 puts both side by side for the complete days both ran (3 at least) and answers close (within 0.75 to 1.25), lower or higher, with a note on the usual causes: bots filtered differently, consent banners, ad blockers, pages without the snippet, cookieless versus cookie visitors.
GA4 through Google Tag Manager? Our tag manager imports a GTM web container (draft/import with format: "gtm", dry run first); the GTM comparison covers it.
Remove GA4 when you decide. Once compare says close and you say so, your agent takes the tag out, or keeps sending GA4 the conversions Google Ads needs.

FAQ

Is Google Analytics 4 free?

Yes, the standard version is free of charge. Analytics 360, with higher limits, longer retention and service level agreements, needs a 360 contract with Google or a Google sales partner, and Google doesn't publish its price. AgentFirstStack's hosted analytics is free with fair-use limits.

Does GA4 use cookies?

Yes. Google's tag sets _ga, used to distinguish users, and _ga_<container-id>, used to persist session state, each for 2 years by default. With Consent Mode and analytics_storage denied it doesn't read or write analytics cookies. AgentFirstStack's tracker sets no cookies by default.

Can an AI agent set up Google Analytics by itself?

Partly. With Google OAuth credentials and the analytics.edit scope, the Admin API can create a property, a web data stream and key events. Creating the account returns a ticket whose Terms of Service a person accepts in a browser, and Google's own MCP server is read-only. The tag and consent setup still go into the site's code.

Can I import my GA4 history into AgentFirstStack?

Yes, as daily totals and breakdowns by page, source, country and device, from a Data API runReport response (also what Google's GA4 MCP server returns) or a report exported as CSV. Events, key event counts, audiences and user-level data aren't imported. imports/compare then checks our daily visitors against GA4's while both run.

How long does each keep my data?

GA4's retention setting is 2 or 14 months on standard properties, up to 50 months on 360, and it only affects explorations and funnel reports, not standard aggregated reports. AgentFirstStack's hosted service keeps raw events for up to 400 days; imported history is kept as daily totals.

Product names belong to their owners. AgentFirstStack isn't affiliated with Google.