The questions I’ve been receiving more and more frequently from web coordinators at mid-sized Dutch municipalities all revolve around the same dilemma: the digital service metrics that have been reported to the council for years come from a tool that’s no longer really allowed to be used. How do you explain that? And more importantly: what now?
That’s not a new question in itself. What is changing is where the urgency comes from. No longer from privacy blogs that alarm the Data Protection Officer, but from annual compliance reports that need to be restructured, from communications managers wondering whether those 187,000 unique visitors in the annual report are even accurate, and from procurement decisions that have to be made in January while the legal landscape is still shifting.
I’ve been working in privacy-first analytics since 2016, first for eight years at Piwik PRO. Over that time, the question of whether Google Analytics fits within a Dutch public sector context has shifted from academic to operational. The question now is what comes next — and how to handle it responsibly without throwing out your entire measurement strategy.
What GA4 does well
It’s tempting to write comparison articles that flatten the competition. That would be unfair here. GA4 is a serious product with serious strengths.
The Google Ads ecosystem is more tightly integrated than any alternative. For organisations that buy advertising at scale and base attribution decisions on campaign data, GA4 is still the path of least resistance. The reporting UI is mature, marketing teams know it, and there’s an entire ecosystem of training programmes, consultants, and agencies built around it.
For commercial organisations this is often decisive. For public organisations it’s rarely the relevant question — municipalities don’t buy Google Ads to direct people to the passport desk. But it does explain why GA4 is still running at so many government organisations: it was there, it worked, it cost nothing, and nobody had a good reason to switch.
Those good reasons now exist.
Where things go wrong for the public sector
The problem with GA4 in a public sector context isn’t one thing. It’s four things, each manageable on its own and together unmanageable.
Where the data goes. Google offers EU-based collection, but that’s not the same as EU data sovereignty. The data sits inside a Google product, where Google largely determines the hosting location and processing conditions, and where the overlap with other Google services is difficult to wall off clearly. For public organisations operating under GDPR, the Cybersecurity Act, and the AI Act, “Google says it’s in the EU” is not the same as “we know where the data is and who can access it”.
What you get back. GA4’s session logic runs largely client-side. Anyone who has spent a week explaining to a leadership team why last week’s figures have changed will recognise the problem. Event retention is capped at 14 months, while public accountability periods typically span years.
Accountability. Writing a DPIA for GA4 is not a matter of filling in a template. Data flows are difficult to describe exhaustively, because they partly originate from Google’s side. Freedom of Information requests for visitor data almost always lead to uncomfortable answers, because the organisation itself often cannot precisely reconstruct what was collected about which visitor.
Lock-in. Exporting GA4 to BigQuery sounds like an exit strategy, but you’re trading one Google product for another. The data stays in Google infrastructure, query costs accumulate, and at some point you still have to migrate to something you actually control. It’s deferral, not a solution.
None of these four is catastrophic on its own. Together, they form the kind of risk that a regulator will sooner or later make visible.
What Govanalytics does differently
Govanalytics is built to solve this specific problem for public organisations that don’t want to rebuild their entire measurement strategy. The technical foundation is D8a.tech, MIT-licensed open source.
Most importantly: Govanalytics accepts GA4 tracking requests. Existing Google Tag Manager implementations, custom events, UTM tagging — it all keeps working. You’re not changing what happens on the website; you’re changing where the data goes. For organisations that have invested years in their GA4 tagging, this is the difference between a one-week migration and a one-quarter migration.
Sessions are built server-side, not client-side. The schema is flat — events, sessions, campaigns, devices, and e-commerce sit in tables you can query directly. Hosting location is a configurable parameter, not a marketing promise: NL managed cloud (in the EU), your own on-prem, or direct to a data warehouse under your control (BigQuery, ClickHouse, Postgres, or other).
What Govanalytics doesn’t do, to be honest: it’s not a Google Ads platform. Several reporting features are on the roadmap but not yet mature. And the dashboard layer is deliberately simpler than GA4’s UI — the assumption is that serious reporting happens in BI tools or in the warehouse.
Govanalytics is not the only route out of GA4
It would be unfair to suggest this is a choice between GA4 and Govanalytics. For the European public sector, four categories genuinely matter.
Piwik PRO
The closest thing to a direct GA replacement. Polish, EU-hosted, mature, with a strong compliance position and a procurement process that understands the public sector.
- Sterk in
- Low-friction migration, strong out-of-the-box compliance position, mature procurement processes, good multilingual support.
- Levert in
- Still a vendor-hosted solution. For organisations that read data sovereignty strictly, the data remains outside their direct control.
- Beste fit
- Ministries and larger municipalities that want low-friction migration with a vendor relationship that works for procurement.
Matomo
The open-source grandfather of the category. Strong if you have internal engineering capacity and prioritise ownership over convenience.
- Sterk in
- Flexibility, ownership, open-source licence. Free when self-hosted, modest when cloud-hosted. No vendor lock-in.
- Levert in
- Requires engineering capacity for long-term management. Patches, scaling, and backups are your own responsibility.
- Beste fit
- Universities and smaller municipalities with capable IT teams that prioritise ownership over convenience.
Plausible
The lightest option. Privacy position so clean that DPO reviews are brief. Deliberately simple, no cookies by default, migration takes a week.
- Sterk in
- Speed of implementation, auditability, low cost, low cognitive load for the team.
- Levert in
- Limited depth for serious marketing operations. No meaningful funnel analysis, attribution, or e-commerce tracking.
- Beste fit
- Content-driven public sites without serious marketing operations. Communications sites, information portals, museums.
Warehouse-native
The category that Govanalytics and D8a.tech belong to. The heaviest option if you don't yet have a warehouse — and the most natural if you already do.
- Sterk in
- Maximum data ownership in your own infrastructure and jurisdiction. Exit portability is structural, not contractual. Costs scale with infrastructure.
- Levert in
- Not a drop-in replacement for GA. Requires a warehouse, pipelines, and someone who understands both.
- Beste fit
- Organisations with an existing data warehouse or sufficient scale to justify building one. Several larger ministries and implementing organisations.
A decision framework that actually works
Four questions that in my experience determine which direction fits.
How deeply is GA4 embedded in your tagging? If your communications team has invested years in GTM tagging, GA4 protocol compatibility matters a lot. If your tagging is limited, it matters less.
What does your team actually need? Be specific. If the real work comes down to “we want to know which information pages are being read and how citizens move through the portal”, that’s a different answer than “we do serious attribution on paid campaigns”. Many public organisations overestimate what they need because they read GA4’s feature set as a list of requirements.
Do you have a data warehouse, or someone who can manage one? If yes, the warehouse-native path is seriously worth considering. If no, that’s no shame — choose a managed option and make sure exit portability is in the contract.
What does procurement actually allow? Some organisations have framework agreements that include or exclude specific vendors. Find this out before drawing up a shortlist, not after.
Answer these four questions honestly and the choice usually narrows itself.
The switch is less painful than most teams think
The biggest myth around GA4 migrations is that it’s a big-bang project: a day when someone pulls the old tag and puts on the new one, with the risk that everything breaks at once.
In practice this rarely happens, and for Govanalytics specifically it doesn’t happen. Because the GA4 tracking protocol is supported, you can run both endpoints in parallel. The website sends the same events to both sides, you compare reports over a few weeks, you validate that the Govanalytics figures match what you expected, and only then do you stop GA4 — or keep it running a while longer for legacy reports.
For public organisations facing an upcoming NIS2 deadline or a DPO review, that’s the difference between “we can sort this out in a quarter” and “we need a year”. In most cases, a quarter is enough.
Where this is heading
The privacy-first analytics category for the public sector is in motion. The interesting movement in the next 12 to 16 months isn’t whether organisations migrate away from GA4 — that decision has been made — but where they land. My assessment is that warehouse-native becomes the architectural endpoint for organisations of any significant size, because there’s no good reason why analytics should be the only workload where a vendor still owns your raw events while everything else runs on infrastructure you manage yourself.
The smart move for public organisations evaluating today: choose the option that fits the current operational reality, with one eye on data portability. Make sure that whatever you choose enables you to extract your raw data and load it into a warehouse later. That’s where the second migration will land.
Schrems II won’t be reversed. NIS2 enforcement won’t ease. The web coordinator from the opening paragraph can still defer this decision, but the sums she’ll face her council with at the end of 2026 won’t improve by waiting. Getting it right the first time costs less than it looks.
Get in touch? Want to know more?
We discuss in 30 minutes which variant fits — Cloud, On-Premise, or building on the open-source core yourself. No sales pitch, no obligations.
Click here to book an online meeting →