Cookieless analytics and GDPR: what needs consent, and what usually does not

"Cookieless" analytics is often sold as "no banner needed, GDPR compliant". That is partly true and easy to overstate. Two different laws apply, they ask different questions, and the answer depends on what your analytics actually does with the visitor's device and data.

This is a plain explanation of how the rules work, not legal advice. Check the rules where you and your visitors are, and ask a lawyer for anything that matters to your business.

Two laws, two questions

The ePrivacy rule (Article 5(3) of the ePrivacy Directive, and each EU country's law that implements it) asks: are you storing information on the visitor's device, or reading information from it? If yes, you need consent, unless it is strictly necessary for a service the visitor asked for. This covers cookies, localStorage, and similar techniques. It applies whether or not the information is personal data.

The GDPR asks: are you processing personal data? If yes, you need a lawful basis (consent is one, legitimate interest is another), you must tell people in your privacy notice, keep the data no longer than needed, and protect it. IP addresses and device identifiers are generally treated as personal data.

A banner is about the first question. A privacy notice and a lawful basis are about the second. Cookieless analytics can remove the need for the first, never the second.

What "cookieless" can and cannot mean

Cookieless tools count visitors without storing anything on the device. A common method: hash the IP address and browser string together with the site and a salt that changes every day, so the same person is recognized within a day and not after.

• Nothing is stored on the device, so the ePrivacy consent rule is usually not triggered by storage.
• The IP address is still processed, in memory, to make the hash. That is processing of personal data under the GDPR, which needs a lawful basis and a line in your privacy notice.
• No cross-day memory. The same person tomorrow is a new visitor. That is the privacy benefit and the measurement cost: multi-day attribution is not possible this way.

The EDPB's guidelines on the scope of Article 5(3), adopted in final form in October 2024, look at techniques beyond cookies, including URL and pixel tracking and tracking based on IP addresses only (EDPB). Their message is that the rule is about access to the device, not the word "cookie". A cookieless tool that fingerprints the device in the browser can still fall under it.

When analytics cookies are exempt

Some regulators allow audience measurement cookies without consent, under strict conditions.

• France (CNIL). Audience measurement trackers can be exempt from consent if they are used only to measure the site's own audience, give anonymous statistics, are not combined with other data or shared for other purposes, and meet limits such as a 13-month tracker lifetime. Visitors must be told and able to object (CNIL).
• United Kingdom. The Data (Use and Access) Act 2025 added an exception to the UK's cookie rule for storage used only to collect statistics about how a service is used, to improve it, with clear information and a simple way to opt out. Law firms report it took effect on 5 February 2026 (Clifford Chance, Bratby Law). Advertising is outside it.
• The rest of the EU. Practice varies by country. The European Commission's Digital Omnibus proposal of November 2025 would allow first-party audience measurement without consent across the EU, but it had not been adopted as of October 2026 (Taylor Wessing).

None of these exemptions cover advertising: retargeting, sending conversions to ad platforms, or tracking people across sites.

What usually needs consent in the EU and UK

What about Google Analytics?

GA4 sets first-party cookies, so in the EU it generally needs consent under the ePrivacy rule. Between 2022 and 2023 several EU regulators, including Austria's and France's, found specific uses of Google Analytics unlawful because of data transfers to the US. The EU-US Data Privacy Framework, adopted by the European Commission in July 2023, changed the transfer question for certified US companies (European Commission). The cookie consent question did not change.

Google's consent mode lets GA4 send cookieless pings when consent is denied and model the gaps, but modeling only switches on for properties above set volumes (Google).

Outside Europe

• United States. No federal cookie consent rule. State privacy laws such as California's give people the right to opt out of the "sale" or "sharing" of personal data, which can include ad pixels. A "Do not sell or share" link and honoring Global Privacy Control signals are the usual answer.
• Elsewhere. Brazil, Canada, Australia and others have their own rules. Check where your visitors are, not only where you are.

A practical setup

1. Run privacy-friendly analytics without storage for everyone. It counts every visit and usually needs no banner, only a privacy notice.
2. Load ad pixels and long-lived ids only after consent, where the law asks for it.
3. Send sales to ad platforms from your server only for buyers whose consent covers it.
4. Say all of this plainly in your privacy notice: what you measure, with which tools, and for how long.

This gives you full visit counts from everyone, and attribution for the people who said yes, without guessing at the law.

Common questions

Do I need a cookie banner for analytics?

In the EU, for analytics that stores cookies or similar data on the device, usually yes, unless a national exemption applies. For analytics that stores nothing on the device, usually no, though you still need a privacy notice and a lawful basis under the GDPR.

Is cookieless analytics GDPR compliant?

No tool is compliant on its own. Compliance depends on how you use it. A cookieless tool makes the ePrivacy part simpler, but you still process personal data such as IP addresses, which the GDPR covers.

Is localStorage a cookie under the law?

The ePrivacy rule covers any storage on or access to the device, so localStorage, sessionStorage and similar storage are treated the same way as cookies.

Can I use legitimate interest instead of consent?

Under the GDPR, legitimate interest can be a basis for some analytics. It does not replace the ePrivacy consent requirement for storing data on the device where no exemption applies.

Sources

• EDPB: Guidelines 2/2023 on Technical Scope of Art. 5(3) of the ePrivacy Directive, version 2.0 adopted 7 October 2024.
• CNIL: Sheet 16, use analytics on your websites and applications. Checked October 2026.
• UK: Clifford Chance on the ICO's updated guidance, Bratby Law on commencement.
• European Commission: EU-US data transfers. Digital Omnibus status: Taylor Wessing.
• Google Analytics Help: Consent mode behavioral modeling.