Analytics consent

Two rules, not one

Two separate pieces of EU law meet here, and people often mix them up.

• The ePrivacy rules govern storing or reading information on a person's device, such as a cookie or an entry in local storage. Consent is the default requirement, with narrow exceptions that member states read differently.
• The GDPR governs the processing of personal data. It needs a lawful basis, and consent is only one of them. A tool that processes personal data for analytics may rely on legitimate interest in some cases, provided it meets the conditions.

A tool can therefore avoid the first and still be subject to the second. That is why "no cookies" is not a complete answer. The guide on GDPR and analytics walks through the difference.

What counts as an answer

Valid consent is freely given, specific, informed and unambiguous. In practice that means:

• Nothing is stored or sent before the visitor answers.
• Refusing is as easy as accepting, with a button of the same weight.
• A pre-ticked box, or a banner closed without a click, is not agreement.
• Withdrawing is as easy as giving it, and withdrawing removes what was stored.

Three setups

1. No consent needed by design. In cookieless mode nothing is stored on the device and no IP address is kept, so no banner is needed for the counting itself. Counts are right within a day; a returning visitor on another day counts as new. Some regulators have narrow exemptions for this kind of measurement, others do not, so check your own authority's position.
2. A cookie, with its own bar. The tool asks first, then stores a cookie. A visitor who accepts is recognised across days. One who declines is not counted at all.
3. A cookie, through the banner you already run. If you already have a consent manager for other services, the tool reads its answer and follows it.

trckable offers all three, with the same rules in each: until someone answers nothing is stored and nothing is sent, a browser that sends Do Not Track or Global Privacy Control is treated as having declined, and a visitor who leaves without answering is counted the way cookieless mode counts. The details are in the consent docs.

Choosing

If you want the least friction, cookieless mode removes the question for the counting itself. If you need to follow visitors across days, for example to credit a sale a week after the first visit, a cookie and a consent step are the honest route. And a banner for analytics does not cover your video embeds, chat widget or ads: each needs its own answer. Ask a lawyer where the stakes are high.

Related terms

• Cookieless tracking
• First-party data
• Server-side tracking

Read more

• Do you need a cookie banner for analytics?
• GDPR and analytics, in plain words