The Promise of “No Banner Needed”

Privacy-focused analytics tools often market themselves as cookieless, and some go further and suggest that you no longer need a consent banner. For a publisher with a lean stack, that is an attractive idea. The reality is more nuanced. Whether consent is needed depends on what the tool actually does on the device, what data it processes, where your users are, and what else runs on your pages.

This article explains the questions to ask before you remove analytics from your consent setup. It is general guidance, not legal advice.

Cookies Are Not the Only Trigger

In the EU, the consent rule for devices comes from Article 5(3) of the ePrivacy Directive. It covers storing information on, or accessing information from, a user’s device — not only cookies. Local storage, session storage, pixels that cause information to be read, and techniques that derive identifiers from device characteristics can all fall within it. The European Data Protection Board set out this broad reading in its Guidelines 2/2023 on the technical scope of Article 5(3).

So “we don’t set cookies” is the start of the analysis, not the end. You need to know whether the tool stores or reads anything on the device at all.

Four Questions to Ask About Any Analytics Tool

1. Does it store or read anything on the device?

Check the browser’s storage panels after a page load: cookies, local storage, session storage, IndexedDB. Check the script for code that collects device characteristics to build an identifier. If anything is stored or read for analytics purposes, the ePrivacy rule is engaged unless an exemption applies.

2. Does it process personal data?

Even without device storage, analytics usually processes IP addresses, user agents and page URLs. Under the GDPR these can be personal data. That requires a legal basis — which can be legitimate interest rather than consent — plus transparency in your privacy notice, data minimisation and appropriate retention. “No banner” never means “no obligations”.

3. Does an exemption apply in your users’ countries?

Some regulators recognise that limited audience measurement can be exempt from consent if strict conditions are met. France’s CNIL has published conditions for exempting audience measurement trackers and maintains a programme identifying tools that can be configured to meet them. Conditions typically include strictly first-party use, aggregated statistics only, no cross-site tracking and limited retention. The UK’s Data (Use and Access) Act 2025 introduced new exceptions to the PECR consent requirement, including for certain statistical purposes, subject to conditions such as clear information and a way to object. Not every country takes the same view, so check the position in each market you serve and which provisions are in force.

4. Is the data shared with anyone else?

If the tool sends data to a vendor that uses it for its own purposes, or combines it across customers, exemptions generally fall away. Read the processing terms, not just the marketing page.

What Usually Still Needs Consent

• Advertising tags. Ad-supported publishers need consent for personalised advertising and for device storage by ad vendors, whatever their analytics tool does.
• Tools with identifiers across sessions. Persistent visitor IDs, even first-party, tend to take a tool outside most exemptions.
• Session replay and heatmaps. These capture detailed behaviour and are rarely treated as exempt measurement.
• Embedded content and social widgets. These set their own cookies and identifiers.
• Conversion and remarketing pixels. These exist to link behaviour to advertising.

For most ad-supported sites, the banner is required for the ad stack regardless. The real question is whether analytics should be one of the gated categories or can run independently under a narrow exemption.

A Practical Way to Decide

1. List every analytics script and what it stores, reads and sends.
2. Identify the countries where most of your users are.
3. For each tool, check whether its configuration meets an exemption recognised in those countries.
4. Configure the tool to the strictest version you need: IP truncation, no persistent IDs, short retention, no data sharing.
5. Document the reasoning and keep the analytics tool listed in your cookie policy and privacy notice either way.
6. Recheck when the vendor changes its product or your markets change.

Running Exempt Analytics Alongside a CMP

If you decide a tool qualifies, list it as strictly necessary or exempt in your CMP so it is disclosed but not gated, and make sure its configuration stays within the exemption. Many publishers also keep a consent-dependent analytics setup for richer measurement and use Google Consent Mode v2 or similar signals to adjust it based on the user’s choice. FlexyConsent supports Google Consent Mode v2 alongside IAB TCF 2.4 and IAB GPP v1.1.

Key Takeaways

• “Cookieless” does not automatically mean “no consent needed”; Article 5(3) covers any device storage or access.
• Analytics without device storage can still process personal data and needs a legal basis and transparency.
• Exemptions for audience measurement exist in some countries but come with strict conditions.
• Advertising, session replay and remarketing tags still need consent.
• Document why a tool is treated as exempt and recheck regularly.