Cookie banners exist because of one rule, and analytics is one of the most common reasons sites show them. Whether your site needs one for analytics depends on the tool you use and how you set it up. This guide explains the rule, what European regulators say about analytics, and what changes with cookieless tools.
This is a plain-language summary, not legal advice. Rules differ between countries and depend on your exact setup; check with your data protection adviser.
The rule: consent before reading or storing on a device
In the EU, the ePrivacy Directive, Article 5(3), says that storing information on a visitor's device, or reading information already there, needs the visitor's consent. The only exceptions are what is needed to send the page, and what is strictly necessary for a service the visitor asked for.
Cookies are the best-known case, but the rule is not only about cookies. In its guidelines on the technical scope of Article 5(3), the European Data Protection Board explains that other techniques that access the visitor's device, such as some tracking pixels and identifiers built from device information, can fall under the same rule.
The GDPR applies on top of this whenever personal data is processed, which includes IP addresses and identifiers linked to a person.
Is analytics "strictly necessary"?
Generally not: a website works without analytics. But some regulators accept that simple audience measurement can be exempt from consent under strict conditions. The French regulator, the CNIL, is the clearest about it. In its guidance on audience measurement, it accepts analytics without consent when the tool is used only to measure the site's own audience, produces anonymous statistics, does not follow visitors across sites, and its data is not reused by the provider for its own purposes.
That last condition is why most large analytics products do not qualify. In the CNIL's words, "most large audience measurement offerings do not fall within the scope of the exemption". Not every country has published an exemption as clear as France's, so the safe reading elsewhere is stricter.
Google Analytics: plan for consent
Google Analytics sets first-party cookies (_ga and _ga_ followed by your property ID, each lasting two years by default, according to Google), and Google uses data for its own purposes. In the EU and UK it is therefore normally loaded only after the visitor accepts analytics cookies.
Google also requires consent signals for its advertising features. Since March 2024, sites that send EEA traffic to Google Ads audiences must use Consent Mode with the newer consent signals. Visitors who refuse are missing from your reports unless your site is large enough for Google's behavioural modelling.
In practice, a site using Google Analytics in Europe shows a banner and loses the visitors who decline. That is a common reason to look at alternatives.
Cookieless tools: often no banner for analytics
Several analytics tools are built to work without cookies or any other storage on the visitor's device. They store nothing on the visitor's device, recognise returning visitors only briefly or not at all (often with a value that changes every day), and the vendors do not reuse the data. Plausible, Fathom, Umami, Simple Analytics, Pirsch, GoatCounter, Rybbit, Seline, Swetrix and TWIPLA in its default mode all work this way, and Cloudflare Web Analytics too.
Their vendors say these tools can run without a consent banner, and under the CNIL's conditions above that is a reasonable reading. Two cautions:
- It depends on your settings. Turning on features that identify visitors, store data on the device or share data with third parties can bring the consent requirement back.
- Your banner may still be needed for other reasons. Advertising pixels, embedded videos, chat widgets and A/B testing tools often set their own cookies.
Tools that offer both modes
Some tools use cookies by default and offer a cookieless mode: WireBoard, Matomo, PostHog, GoSquared and Statcounter among them. With these, the usual approach is to start in cookieless mode and switch to cookies only after the visitor accepts them in your banner. WireBoard's documentation recommends exactly this: start cookieless, and turn on cookies "once your visitors give consent through your CMP". You keep counting everyone, and you get more precise returning-visitor figures from those who agree.
A quick checklist
- List every script on your site that stores or reads anything on the visitor's device. Our analytics detector shows the analytics and tracking tools a page loads.
- For analytics, choose a cookieless tool or a cookieless mode if you want to avoid asking for consent.
- Keep your consent banner for everything else that needs it, and load those scripts only after consent.
- Describe your analytics in your privacy policy: what is measured, by whom, and where the data is stored.
- Check the settings again whenever you add a feature such as user identification or session recording.
Choosing a tool? Our comparison filters by cookieless tracking, and the guide to choosing a web analytics tool covers the other questions to ask.