August 21, 2026 · Updated October 21, 2026
The Ghost Town in Your Dashboard: Why GA4 and Clarity Fail on Privacy-First Browsers
You spent weeks setting up custom conversion triggers in Google Analytics 4 (GA4). You installed Microsoft Clarity so you could watch session replays and heatmaps of real users navigating your site.
You open your dashboard, and everything looks crisp. You have a 2% conversion rate and 5,000 monthly visitors.
Here’s the uncomfortable part: you are almost certainly missing some of your real traffic, and the more technical your audience, the more you miss.
The users you aren’t seeing aren’t bots. They are often your most tech-savvy visitors: people using Brave, Firefox, strict ad-blockers, or simply clicking “Reject All” on your cookie banner.
Legacy analytics tools were built for an internet that has changed. Here is why they break down, and what cookieless analytics does differently.
The Death Spiral of Legacy Tracking
Legacy tools like GA4 and Microsoft Clarity rely heavily on three core mechanics to work:
- Client-side persistent cookies (to stitch sessions together over days or weeks).
- Heavy JavaScript tracking scripts (that record mouse movements, DOM changes, and network calls).
- Cross-site advertising networks & fingerprinting mechanisms.
When a user lands on your site today, two major walls immediately block these tools:
Wall 1: The “Reject Cookies” Wall
When a user clicks “Reject All,” GA4 is restricted from dropping tracking cookies in their browser.
Google’s answer is Consent Mode and behavioral modeling. When users opt out, GA4 can send cookieless pings and then use machine learning to estimate what those users did, based on the users who did accept cookies.
That means part of what GA4 reports for those visitors is a model, not observed behavior.
Microsoft Clarity has its own consent settings too, and when consent is withheld it records less. Check how it is configured on your site.
Wall 2: The Browser Shields (Brave, Firefox, uBlock)
Even if you don’t use a cookie banner, privacy-focused browsers and extensions can stop legacy scripts at the network level before they run:
- Brave Browser: Shields block Google Analytics and Clarity scripts by default. To Brave,
google-analytics.com/analytics.jsis an ad tracker, plain and simple. - Firefox (Enhanced Tracking Protection): In strict mode it blocks known tracking domains.
- uBlock Origin / DuckDuckGo: Blocker extensions maintain large blocklists that cover GA4 and Clarity requests.
If a large share of your audience uses Brave, Firefox, or ad-blockers, they don’t show up in your GA4 dashboard at all. Your analytics are reporting on a biased subset of visitors. How big the gap is on your site is worth measuring (see step 2 at the end).
Legacy vs. Privacy-First Analytics: The Breakdown
| Feature | Legacy Analytics (GA4, Clarity) | Privacy-First Analytics (Mitr, Plausible, Umami) |
|---|---|---|
| Tracking Method | Persistent cookies & browser storage | Hashed identifiers, nothing stored on the device |
| Cookie Banner Needed? | Usually yes, because they write to the device | Usually no, if nothing is stored or read on the device (check your own legal position) |
| Brave / Firefox Blocking | Often blocked by default network shields | Less often, especially when proxied through a first-party subdomain |
| What You See | Observed data plus modeled estimates | Counted events, not modeled |
| Script Weight | gtag.js is large (check it in DevTools) | Mitr’s tracker is about 6 KB gzipped |
The Way Forward: How Privacy-First Analytics Works
Privacy-focused platforms (such as Mitr, Plausible, Umami, Fathom, or PostHog in cookieless mode) don’t try to outsmart privacy laws or trick browsers. They change what is measured.
1. Hashes Instead of Cookies
Instead of writing a cookie like _ga=GA1.2.123456 to a visitor’s browser, tools such as Plausible and Umami generate a temporary hash on the server, roughly:
Hash = IP Address + User Agent + Daily Salt
That lets them know Person A viewed three pages today without storing the IP address or setting a cookie. Tomorrow the salt changes, so the same person produces a different hash.
Mitr takes a different route to the same goal: user IDs are hashed with SHA-256 on the device before they are sent, and the server derives a pseudonymous token with an HMAC using a daily-rotating key, so the raw ID never arrives. The longer write-up is in Why we built analytics without cookies.
On the legal side: the cookie-consent rule in the EU’s ePrivacy Directive is triggered by storing or reading information on the visitor’s device. If you don’t, that rule generally doesn’t apply. Whether other consent or notice duties apply to the processing itself depends on your country’s law and on what else you collect, so check your own situation.
2. First-Party Proxying
Because privacy-first analytics tools don’t sell data to third-party ad networks, you can route their tracking script through your own domain (e.g., analytics.yourdomain.com).
When Brave or uBlock checks the network request, it sees a lightweight request to your own server, not a third-party data broker. The script is far more likely to load, and your pageview count is closer to reality. Mitr supports this natively — see setting up a first-party proxy for the actual DNS and config steps.
3. Focus on Aggregated Metrics Over Individual Surveillance
Legacy tools tried to build detailed individual profiles: What did User #8912 do across 14 different sessions over 6 months?
Privacy-first analytics asks a much healthier question: How many total people visited /pricing today, where did they come from, and what percentage converted?
What You Should Do Next
If you rely on web traffic to run your business, building your strategy on top of GA4 alone means deciding with part of the picture missing.
- Ditch the Google-Only Mindset: You don’t have to delete GA4, but stop treating it as the absolute source of truth.
- Deploy a Lightweight Privacy-First Tool alongside GA4: Run a cookieless tool like Mitr next to your existing GA4 setup — since it never touches cookies or local storage, Brave, Firefox, and uBlock treat its (optionally first-party-proxied) requests as ordinary site traffic instead of an ad tracker. Compare your daily pageview counts between GA4 and Mitr for a week. The gap you see is specific to your audience, and a developer-heavy site will usually show more than a general consumer one. See Mitr vs GA4 or what’s actually being tracked for the specifics.
- Prioritize Speed and Trust: Fewer and lighter tracking scripts can help your Core Web Vitals and respect your visitors’ hardware and battery life.
The era of unrestricted web surveillance is over. The future of web measurement isn’t about collecting more data on individuals — it’s about collecting accurate, aggregate data while respecting the boundaries your users set.