Do you need a cookie banner for analytics?

If your analytics sets cookies or stores anything in your visitors’ browsers, you almost certainly need consent, and in practice that means a banner. If it stores nothing on the device, recognises no one and only produces statistics for you, you often don’t.

Between those two is a grey zone, and where you land depends on the country your visitors are in. This article explains why the rules exist, what they actually require, where analytics can run without a banner, and what a banner costs you when it can’t.

A disclosure first: we build Privatrak, an analytics tool that works without cookies, so we have a stake in this question. We’ve tried to answer it straight anyway, including the parts that don’t flatter tools like ours.

This covers the EU, Germany, France and the UK, as of October 2026. It is general information, not legal advice.

Why these laws exist

Cookie banners are annoying, so it’s easy to see the law behind them as bureaucracy. It isn’t. It answers a real problem.

For most of the web’s history, visiting a page meant being followed. A news site could load dozens of third-party scripts, each setting its own cookie and recognising you across every other site that used it. From those visits, companies built profiles: your interests, your health worries, your politics, where you are. Those profiles are traded in the background of every page that shows ads. In 2022 the Irish Council for Civil Liberties estimated that ad auctions expose a European’s data 376 times a day, including what they read and where they are.

European law answers this with two ideas:

• Privacy and data protection are fundamental rights, listed side by side in Articles 7 and 8 of the EU Charter of Fundamental Rights. They aren’t a setting a company can switch off for you.
• Your device is part of your private sphere. The ePrivacy Directive says so in recital 24: nobody should store things on it or read from it without your knowledge. That’s why the cookie rule protects the device, not only personal data.

The idea behind consent is that you decide whether to be tracked. In practice, banners have made that decision a chore you face on every site, often designed to steer you towards “Accept”. That is the banner failing, not the principle. The principle points somewhere better: measure what you need without touching what belongs to the visitor.

Two different laws, and only one of them is about cookies

Most confusion about cookie banners comes from mixing up two European rules. They ask different questions, and an analytics setup has to pass both.

The cookie banner exists because of the first rule. Regulators have consistently said that analytics is useful to you but not strictly necessary for the visitor, so analytics cookies need consent. That’s why Google Analytics, or any tool that drops a visitor ID into a cookie, comes with a banner.

The GDPR alone rarely forces a banner for analytics, because legitimate interest can cover modest, privacy-respecting measurement. It still sets the rules for what you do with the data, which comes up again below.

In Germany the ePrivacy rule is §25 of the TDDDG, which was called the TTDSG until May 2024. Many German articles still use the old name.

What counts as touching the device

The ePrivacy rule isn’t limited to cookies. Anything that stores information on the visitor’s device, or reads it back, is covered.

Clearly covered:

• Cookies, first-party or third-party.
• Browser storage: localStorage, sessionStorage, IndexedDB. Swapping a cookie for a localStorage entry changes nothing legally.
• Fingerprinting: reading screen size, installed fonts, canvas rendering and similar traits to build an ID that survives cleared cookies. Regulators have treated this as reading from the device since 2014.

The grey zone: the European Data Protection Board (EDPB), where the EU’s privacy regulators coordinate, reads the rule broadly. In its Guidelines 2/2023 (final version adopted 7 October 2024), it says JavaScript that tells the browser to send information to a server counts as “gaining access” to the device (paragraph 33). It says an IP address can fall under the rule too (paragraph 55). By that reading, almost any analytics script is covered, cookies or not.

The same guidelines add the part that is often left out: being covered “does not systematically mean that consent needs to be collected”, and each case has to be checked against the exemptions (paragraph 56). The guidelines aren’t law either. National regulators and courts decide, and as the next section shows, they don’t all decide alike.

So dropping cookies removes the clearest reason for a banner, but not every question. What matters next is what the script sends, whether anything in it can single out a person, and who gets the data.

When you can skip the banner

Two countries spell out an analytics exemption, one has none, and the EU is debating one. Every exemption is built for the same thing: counting visits to your own site, not following people around the web.

France: yes, on the CNIL’s conditions

The French regulator lets audience measurement run without consent when it is used only to measure your own site or app, isn’t combined with other data, and each tracker serves only one publisher. The last byte of the IP address must be removed, and trackers last at most 13 months. Visitors must be told and be able to object, and your vendor must not reuse the data for itself.

United Kingdom: yes, since 5 February 2026

The Data (Use and Access) Act added a statistical purposes exception to PECR, in force since 5 February 2026. It covers storage or access whose sole purpose is statistics about how your service is used, so you can improve it. Visitors get clear information and a simple, free way to object. Anything that also feeds advertising still needs consent.

Germany: no dedicated exemption

§25 TDDDG exempts only transmitting a message and what is strictly necessary for a service the visitor asked for. The usual route is a tool that stores nothing on the device and reads no device traits. Whether a script that only reports page views and clicks counts as access is not settled.

The rest of the EU: it depends on the regulator

Most countries follow the Directive’s wording, which has no analytics exemption.

The EU, proposed: not law yet

The Commission’s Digital Omnibus, published on 19 November 2025, would move the cookie rule into the GDPR as Article 88a, with an exemption for aggregated audience measurement of your own service. It is still going through the European Parliament and the Council.

A practical test

Your analytics is on the defensible side of the line when all of these hold:

1. Nothing is stored on the device. No cookies, no localStorage, nothing.
2. No fingerprinting. The script doesn’t read device traits to build an identifier. It uses only what the browser sends with every request anyway.
3. No one is recognised over time. A returning visitor tomorrow is a new visitor, and there is no ID that could link the two.
4. The data stays yours. It is used for your own statistics, not combined with other sites’ data, and the vendor doesn’t reuse it.
5. No raw personal data is kept. IP addresses are not stored, or are cut short before they are.
6. People are told, in your privacy policy, and can object where the law asks for it (France, the UK).

What you still owe without a banner

No banner doesn’t mean no obligations. The GDPR still applies to whatever personal data passes through, even if only for a moment.

• Mention it in your privacy policy. Say which tool you use, what it collects, why, and for how long. Articles 13 and 14 of the GDPR require this whether or not you ask for consent.
• Name your legal basis. Without consent, it is usually legitimate interest (Article 6(1)(f)). Write down the short balancing test: what you measure, why you need it, and why it doesn’t outweigh your visitors’ privacy. Minimal data makes this easy to pass.
• Sign a data processing agreement with your analytics vendor (Article 28). A serious vendor offers one without being asked twice.
• Know where the data goes. Hosting in the EU avoids questions about transfers to other countries. Being exempt from consent doesn’t settle those questions.
• Offer a way to object where the exemption requires it. In France and the UK, a link in the privacy policy that switches tracking off for that visitor is the usual way.
• Check the rest of your site. The banner question is about everything on the page, not only analytics. An embedded YouTube video, a chat widget, an ad pixel or a font loaded from a third party can each raise a consent or data protection question of its own. Cookieless analytics doesn’t help if something else on the page still sets cookies.

Why it’s worth not needing a banner

Analytics that respects privacy is the right thing to do for your visitors. It also turns out to be better for you.

A fair banner loses you most of your visitors. A 2024 study of millions of banner interactions found that more than 60% of people decline when rejecting takes one click. When rejecting takes more clicks, about 90% accept. For years, high consent rates came from that second design, and regulators now punish it. In December 2021 France’s CNIL fined Google €150 million and Facebook €60 million because refusing cookies was harder than accepting them. With an honest banner, your analytics sees a minority of your traffic.

The minority you do see is skewed. People who click “Accept” aren’t a random sample of your visitors, and people who ignore the banner aren’t counted either. You can’t know how those groups differ, so you can’t correct for it. A conversion rate measured on 40% of visitors may not hold for the other 60%.

The first thing visitors see is your page. A banner is a request made before you’ve given anything. Without one, people meet your product first, and you start the visit without asking for their trust.

Less data means less to protect. Data you never store can’t leak, can’t be demanded by anyone, and doesn’t have to be found when someone asks what you hold about them. Data minimisation is a GDPR principle, but it is also simply less risk.

Is it fair to count people who would have declined? It’s a fair question. What people decline is being tracked: a cookie that recognises them, a profile that follows them, data that ends up with advertisers. Counting a visit to your own site, without recognising anyone, is a different thing. That’s why France and the UK exempt it. Where someone does object, honour it.

Questions to ask an analytics vendor

“Cookieless” and “GDPR-compliant” are on almost every analytics homepage. These questions get past the label:

1. Does your script store anything in the browser, under any name?
2. How do you tell visitors apart, and for how long can you recognise the same one?
3. Do you read device traits such as screen size, fonts or canvas output?
4. Do you store IP addresses, even shortened or hashed with a fixed key?
5. Do you use our visitors’ data for anything else, such as benchmarks, product training or other customers?
6. Where is the data stored, and which subprocessors see it?
7. Can we sign a data processing agreement?
8. Which features need consent? Some tools are cookieless in a basic mode, while session replay, surveys or cross-device tracking switch the cookies back on.

Vague answers to the second and fourth questions are the usual warning sign. “We hash the IP” means little if the same key is used forever, because the hash then works as a permanent ID.

How Privatrak answers those questions

We built Privatrak so that it stores nothing on the device, reads no device traits, forgets every visitor after one day, uses your data only for your own reports, and never stores IP addresses. The one part it can’t do for you is telling your visitors, so name it in your privacy policy.

• The tracker stores nothing in the browser and reads no device traits.
• To tell visitors apart, the server combines the IP address, the browser’s User-Agent and your site into a one-way hash, using a random key for that day. The IP address and User-Agent are never stored.
• Every night the day’s key and visitor IDs are deleted, so a visitor is recognised for one day at most, and nobody, us included, can link them to the day before.
• Data is hosted in the EU, used only for your reports, and covered by a data processing agreement.
• If you need an objection link, the tracker can wait to start until your page has checked the visitor’s choice (data-manual-init).

It still measures what product teams need: which features people use, where they drop out of a funnel, and which campaigns bring them in. Privacy in the docs explains each step in detail.

Sources

Checked on 9 October 2026. What applies to you depends on where you and your visitors are and on everything else your site loads, so check with a lawyer for your situation.

• Irish Council for Civil Liberties, Report on the scale of real-time bidding data broadcasts in the U.S. and Europe, 16 May 2022
• Jha, Trevisan, Mellia, Fernandez, Irarrazaval, Privacy Policies and Consent Management Platforms: Growth and Users’ Interactions over Time, 2024
• CNIL, The sanctions issued by the CNIL (entries of 31 December 2021)
• EDPB, Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, version 2.0, 7 October 2024. Paragraph 28 quotes recital 24 of the ePrivacy Directive.
• Germany, §25 TDDDG
• CNIL, Sheet n°16: Use analytics on your websites and applications and Cookies : solutions pour les outils de mesure d’audience
• UK, The Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026, SI 2026/82
• ICO, What are the exceptions?
• Osborne Clarke, Digital Omnibus package