Skip to main content
Status: draft, pending legal review (input I10). Not legal advice. Last updated 2026-11-13 (remaining EU and EEA states, United States, Brazil and the Omnibus status added from primary sources). This is the explicit jurisdictions statement the RFP asks for. Every row cites sources.md; a row without a confirmed source says so.

Why this needs a per-country answer

The tracker runs JavaScript that makes the browser send information (page path, referrer, title, screen, language) and reads one browser storage key (the opt-out flag). That is all the default tracker reads. On a site that opts in to Wallets Kit capture with the script tag (data-wallets-kit="true"), it also lists the names of the site’s localStorage keys twice a second and reads the kit’s selected wallet id (never the address), from the moment tracking starts and never for a visitor with Global Privacy Control, the opt-out flag or an honoured Do Not Track, even when the site calls umami.start() for such a visitor (tracker 1.2.0; 1.1.0 started the watcher on umami.start() without that check). The exact list and timing is in privacy-strategy.md section 6. That reading is access to stored information in its own right under Art. 5(3) of the ePrivacy Directive, so this table covers the default tracker only, and a tenant that turns Wallets Kit capture on must add it to its own assessment: where a row below says no opt-in is needed, that holds for the default tracker, and the Wallets Kit read needs its own exemption or the visitor’s consent (consent mode below). The EDPB says that a script instructing the browser to send information “clearly falls within the scope” of Art. 5(3) of the ePrivacy Directive (S1, para 33), and that whether an exemption applies is for the national rules (S1, para 56). Cookieless measurement is therefore not exempt from consent by itself; it depends on each country’s exemption. The service gives tenants two modes:
  • Default mode: the tracker starts on page load. It honours Global Privacy Control, the opt-out flag and, when enabled, Do Not Track (privacy-strategy.md section 6).
  • Consent mode: data-auto-track="false"; the tracker sends nothing and reads nothing until the site calls umami.start() after the visitor agrees (docs/reference/wire-v1.md).

Summary table

“Default mode possible” means the source supports measurement without prior consent under conditions, and the service as built meets the conditions we could check. It is never a guarantee: each tenant is the controller and decides for its own site.

What tenants must do in every jurisdiction

  • Name the service and the processing in the site’s privacy notice.
  • Offer a simple opt-out link that sets the opt-out flag (localStorage.setItem('umami.disabled', '1')).
  • Put no personal data in URLs, page titles, referrers or event data (terms.md).
  • Where in doubt, use consent mode.

Pending EU change

The Commission’s Digital Omnibus proposal COM(2025) 837 (procedure 2025/0360(COD)) would add a GDPR Art. 88a allowing storage or access without consent for aggregated audience measurement by the controller of an online service for its own use. Status on 2026-11-13 (S14):
  • It is a proposal at first reading and has no legal effect. National Art. 5(3) laws apply unchanged.
  • Parliament: ITRE and LIBE (joint committee) have a draft report (22 June 2026) but have not voted. OEIL shows “Awaiting committee decision”.
  • Council: Coreper agreed its negotiating mandate on 21 October 2026 (ST 14756/26). In that text Art. 88a appears to be deleted, and the audience measurement exemption moves into ePrivacy Art. 5(3), narrowed to “anonymous aggregated information”, allowed for a third party acting for the provider, with no other purpose, sharing or combination. Member States would have 24 months to transpose.
  • Trilogues cannot start until Parliament adopts its position. The final text may differ from both versions.
The separate AI omnibus (COM(2025) 836) became Regulation (EU) 2026/1744; it does not contain Art. 88a.