webtracking.org
C 68/100

PostHog

Open-source product analytics; self-hostable for full control. Powerful but autocapture and session replay can collect a lot by default.

verified 2026-06-08 · grade set per the published methodology

How the grade breaks down

Data minimization 3/5

How little it collects, and whether collection is purpose-bound.

Consent honoring 3/5

Whether it respects GPC, consent state, and tracking-prevention signals.

Identifier strategy 3/5

Cookieless vs. persistent IDs, cross-site linkage, fingerprinting risk.

Residency & sharing 4/5

Where data lives and whether it is shared with third parties.

Transparency 4/5

How verifiable and documented its real behavior is.

At a glance

Category product-analytics
Cookieless optional
Consent for lawful use required
Data residency mixed
Shares w/ third parties no
Sends PII by default optional
Honors GPC partial
Open source yes

PostHog is open source and self-hostable, which when self-hosted gives full data ownership (the posture that earns its grade; managed cloud is weaker). Its strength — autocapture, session replay, and identity stitching — is also its privacy risk: out of the box it can capture far more than aggregate analytics, and replay can record sensitive inputs unless masking is configured. It supports EU cloud and offers consent/opt-out controls, but a privacy-safe deployment requires deliberate configuration (disable autocapture where not needed, mask replay, gate on consent).

Sources & basis for grade

Grades reflect documented behavior, vendor documentation, and ad.rip scans as of the date above. Each assessment is reproducible and vendors may request correction.

  • PostHog privacy/configuration documentation
  • PostHog session-replay masking docs
  • PostHog open-source repository