Do you need a cookie banner for analytics?

Two sets of rules, not one

People say "the GDPR requires a cookie banner". It does not, quite. Two laws sit side by side, and the banner comes from the second.

The GDPR governs personal data: what you may collect, on what legal basis, and what you owe the people it describes. The ePrivacy Directive, in Article 5(3), governs the device: you need the person's consent before storing information on it or reading information from it, unless that is strictly necessary to deliver a service they asked for. Each EU country wrote that into its own law, with its own exemptions.

So passing one test does not pass the other. A tool can be careful with personal data and still read the device. Another can touch the device and still be an exempt, low-risk measurement under local rules. That is why the table below is by country.

The table

These are the general lines as we understand them in October 2026. National rules and regulators' views move, so read your own authority's current guidance before you rely on a row.

Why removing the cookie is not the whole answer

European regulators read "accessing the device" widely. The EDPB, the body of EU data protection authorities, says in its guidelines on the technical scope of Article 5(3) that the rule is not limited to cookies: local storage, fingerprinting and reading device information fall under it too. A script that sends the page address, the referrer, the screen width and the language is reading the device, cookie or not.

That makes cookieless tracking a strong simplification and not an automatic exemption. It removes the storage, and with it most of the privacy risk. Whether a given country then lets you skip consent is the table's question. The longer reasoning is in cookieless analytics and GDPR.

Five questions that settle it

Answer these for your own site and you will know which row applies.

1. Where are your visitors? The rules follow the visitor, not your company. A German visitor to a US site is still protected by German law.
2. Does your script store or read anything on the device? A cookie, local storage, a stored ID, fingerprinting. If yes, you need consent unless the exemption for your country applies.
3. Is the data used only for your own statistics? No cross-site tracking, no sharing, no advertising use. Exemptions usually depend on this.
4. Can a visitor object? Exempt measurement typically still requires that people are told and can opt out.
5. What else is on the page? Ads, embedded video, chat widgets and social buttons set their own cookies and need their own consent, whatever your analytics does.

What cookieless mode does in trckable

With the switch on, for every visitor wherever they live:

• nothing is stored in the browser: no cookie, no local storage, no queue of unsent events
• visitors are counted with a daily hash of their IP address and browser, and no IP address is stored anywhere
• the region and city are dropped, the country stays
• Do Not Track and Global Privacy Control are honoured

You give up recognising a returning visitor across days. A unique visitor is new each day, and counts are right within a day. That is the price of storing nothing, and for most sites it is a fair one.

What the exemptions usually ask for

The wording differs, but the conditions repeat: the data serves your own site's statistics only, nothing is tracked across sites or shared for others' purposes, visitors are told and can object, and data is not kept longer than needed (in trckable you choose how long a site's data is kept: 30 days to 3 years, or until you delete it). trckable loads nothing from another company, and Cloud data is hosted in the EU. Those facts help you meet the conditions. Whether your country's exemption applies to your setup is still your call, and your lawyer's.

If you keep the cookie

You may want a stable first-party visitor ID across days. Then ask first, in the EU and the UK, and ask properly: the Court of Justice has held that a pre-ticked box is not consent (Planet49, C-673/17). Refusing should be as easy as agreeing, and nothing non-essential should load before the answer.

trckable has its own cookie bar, where refusing is as easy as agreeing, and it can read a consent manager you already run (Google Consent Mode v2 or IAB TCF v2.2). A visitor who declines is not counted. The consent docs have the details.

Questions

Do I need a cookie banner if I use cookieless analytics?

Often not for the analytics itself in countries with an exemption, such as France when the conditions are met. In Germany and Austria consent is generally still expected. Other things on your page, such as ads or video embeds, may need a banner anyway.

Do I need a banner in the US?

There is no federal cookie-consent rule. State privacy laws focus on selling and sharing personal data and on honouring opt-out signals. trckable does not sell or share visitor data.

Does the GDPR itself require a cookie banner?

No. The banner comes from the ePrivacy rules about the device, which each country wrote into its own law. The GDPR sets the standard for what counts as valid consent once you need it.

Is this legal advice?

No. It is a plain summary of general lines, written by people who are not your lawyers. Rules are national and change, so ask a lawyer who knows the countries your visitors are in.