French founders build a disproportionate share of Europe’s indie SaaS, often in English for the world, sometimes in French for the hexagon, almost always with Stripe, Notion, and a quiet anxiety about CNIL letters they have never received. This guide collects practical patterns for analytics on a marketing site without turning you into a compliance blogger. It is not legal advice. Pair it with counsel when money or risk spikes.
The technical baseline lives in the cookieless analytics guides hub and the main guide analytics without a cookie banner for EU SaaS. Here we focus on France-shaped habits: privacy page wording, what teams actually install, how they explain sessionStorage to enterprise buyers, and when they still show a banner.
The French market is not a monolith
Selling from Paris to US developers is different from selling HR software to French SMBs. Buyers in the second camp ask about hébergement, RGPD, and sous-traitants in the first call. US-oriented micro-SaaS may never hear those questions until the first EU enterprise trial.
Analytics posture should match who reads your privacy policy:
- Developer tools: technical honesty (“session-based, no ad cookies”) often lands better than vague “we respect GDPR.”
- Regulated-adjacent (health, education, public sector): expect formal DPIA questions, cookieless first-party may still need documented retention and DPA.
KiboData’s French UI exists because many teams market bilingually; your analytics definitions should be the same in both languages to avoid arguing with yourself in committee meetings.
CNIL and “analytics cookies”, what founders misunderstand
CNIL has published extensively on cookies and trackers. Founders remember headlines: consent required, banners, fines. They forget nuance:
- Guidance distinguishes exempt measurement (tightly scoped) from advertising trackers.
- Google Analytics historically triggered more scrutiny than small first-party stats, especially when data crossed borders or identifiers were rich.
- Cookieless does not mean CNIL-free. CNIL cares about finalités, données, durées de conservation, and droits des personnes: not only whether
document.cookiewas called.
Practical founder move: read CNIL’s summaries for your situation, then ask a French avocat or DPO if you process sensitive data, children, or large-scale monitoring. Most ten-person SaaS marketing sites are not that case, but your lawyer confirms.
Privacy page copy that matches reality
French and English privacy pages often overclaim because a template said “we are fully compliant.” Better pattern:
- Identify the controller (your SASU or equivalent) and contact email.
- List categories: navigation analytics, server logs, payment processor, support inbox.
- Name the analytics tool and host region if known.
- Describe the browser identifier: “identifiant de session stocké dans sessionStorage, supprimé à la fermeture de l’onglet” / “session identifier in sessionStorage, cleared when the tab closes.”
- Retention on the server (e.g. 13 months aggregated, pick a number you enforce).
- Rights: access, deletion, with a mailbox that someone checks.
If you use KiboData, link to their DPA/subprocessor list when your contract provides it. Do not paste “zero personal data” unless engineers verified fields.
Cookie banners on .fr marketing sites
Three real-world setups among French indie SaaS:
A. No banner, minimal first-party analytics only Teams that removed GA, run one sessionStorage script on kibodata.com or self-hosted ingest, and avoid ad pixels. They document intérêt légitime or exempt analytics with counsel sign-off. Risk tolerance varies, this is not a recommendation, a observed pattern.
B. Banner for non-essential tools only Analytics stays lean; banner appears because of YouTube embeds, Crisp/Intercom, or LinkedIn Insight. Cookieless analytics reduces vendors in the “reject all” path.
C. Banner with analytics opt-in Conservative enterprises and agencies choose explicit opt-in for any stats script. Expect undercount; compare relative trends, not absolutes vs opt-out tools.
If you are in bucket C, sessionStorage does not rescue you from opt-in, the script still loads after consent. Architecture matters less than consent gating.
Bilingual sites and one analytics project
Founders often run example.com (EN) and example.com/fr or fr.example.com. Rules of thumb:
- One KiboData site per product with path segmentation (
/fr/pricingvs/pricing) beats two projects unless billing separation demands it. - UTM campaigns should encode language (
utm_content=fr-launch) when newsletters differ. - CNIL-facing copy on
/fr/legal/confidentialiteshould mirror EN facts, not contradict them on retention days.
French customers appreciate French legal pages even when the product UI is English, analytics numbers should still roll up to one founder dashboard.
Enterprise security questionnaires
When a French prospect sends a 200-row Excel “RGPD” tab, rows about analytics usually ask:
- Where is data stored (EU region?)
- Is IP stored? Truncated?
- Cookie duration? (Answer: no analytics cookies; sessionStorage tab-scoped.)
- Subprocessors?
- SCCs / adequacy?
Prepare a one-pager aligned with sessionStorage tradeoffs: sessions not people, webhook revenue separate from browsing, no cross-site ad graph.
If you cannot answer IP handling, check your ingest pipeline, truncation at the edge is a common engineering fix questionnaires expect.
Stripe, TVA, and analytics confusion
French founders juggle TVA, micro-entreprise thresholds, and Stripe Atlas myths. Analytics does not calculate VAT. Do not merge finance compliance with tracker choice except where invoices need customer country, that is billing metadata, not pageviews.
Do connect Stripe webhooks to analytics so revenue per visitor reflects French campaign weeks (e.g. after a talk at Station F or a Maddyness feature). The revenue per visitor guides helps read thin samples honestly.
Docs, blogs, and AI crawlers
French dev tools often publish docs in English; blog may be bilingual. Crawler traffic (Googlebot, ChatGPT-User, Perplexity) spikes can dwarf human sessions for a week, see the AI crawler guides.
For EU positioning, being indexed is good; mistaking bot hits for “viral growth” is bad. Filter or label bots in dashboards you use for marketing decisions, not security logs.
Working with French agencies and freelancers
Agencies love installing GA4 + GTM + Meta pixel in one afternoon. Founders who want cookieless analytics need a brief:
- No third-party marketing tags without approval.
- UTMs on every newsletter link (agencies forget).
- Test purchases after deploy.
Put the brief in the Notion you already use for UTMs. Fire freelancers who add Hotjar without asking.
When French founders still choose Google Analytics
Reasons we hear:
- Acquirer or investor wants GA screenshots.
- Co-founder comfort with interface.
- Free tier and habit.
Migration path: run parallel briefly, then remove GA to simplify banner scope. French users who opted into GA are not comparable to session counts, document the cutover date in your changelog.
Hosting and “données en Europe”
“EU hosting” is a sales checkbox. For analytics, clarify:
- Ingest endpoint region
- ClickHouse/DB region (vendor docs)
- Whether failover crosses borders
Cookieless does not automatically mean EU-only; verify vendor statements. Self-hosting ingest on analytics.yourdomain.com FR proxy is advanced, most indie teams buy hosted EU processing instead.
Incidents founders should plan for
- Accidental PII in URL (
?email=on a shared link), strip query params at ingest or avoid logging full URLs. - Customer asks for deletion: know how to delete or anonymize events for a session or domain.
- Badge or script removed: KiboData free tier may pause ingest until badge verification passes; French indie sites sometimes forget the dofollow badge on the homepage footer.
Cultural tone in metrics meetings
French product culture can be more skeptical of growth hacking metrics than US Twitter discourse. Present sessions, revenue, pinned weeks: not “hockey stick users.” Proportionate measurement matches proportionate rhetoric.
When a prospect says “we do not want cookies,” you can demonstrate sessionStorage mechanics in DevTools Application tab, technical buyers nod; others need the French privacy page.
Checklist before you launch a .fr campaign
- Privacy page updated EN + FR with sessionStorage wording.
- Newsletter links carry UTMs (
utm_source=newsletter_fr). - One test checkout visible in analytics + Stripe.
- Banner scope reviewed if any new embed crept in.
- Internal definition: we report sessions, not MAU.
Related guides
- Main guide: analytics without a cookie banner for EU SaaS
- Mechanics: sessionStorage visitor counting tradeoffs
- Limits: what you cannot measure without cross-site IDs
France rewards products that are clear, not loud. Cookieless analytics fits that ethos when your copy, privacy page, and sales one-pager tell the same story: we measure our site to improve it, we do not sell your browsing history, and we know the difference between a session and a person.