Do you need a cookie banner for analytics?

The honest answer is: it depends on what your analytics tool does, not on what it is called. “Analytics” is not a legal category. The law cares about two questions — are you storing something on the visitor's device, and are you processing personal data — and a tool either triggers those or it does not.

This post walks through both questions, what the actual texts say, and how to check your own setup in about a minute. It is written by people who build an analytics tool, so treat the framing as informed but interested — and treat the primary sources as the authority.

Two different laws, commonly confused

Almost every argument about cookie banners is really two laws being treated as one.

The ePrivacy Directive governs the storage

Article 5(3) is the rule that produced the banner. It says that storing information on, or reading information from, a user's device requires consent — regardless of whether that information is personal data. That last part is what surprises people: a purely technical identifier still needs consent if it lives on the device.

There are two exemptions. Storage that is strictly necessary to deliver a service the user explicitly requested, and storage whose sole purpose is carrying out a transmission. A session cookie that keeps someone logged in is exempt. An analytics cookie is not: the visitor did not ask for measurement.

The key point for this question: if your tool writes nothing to the device, Article 5(3) does not apply at all. No cookie, no localStorage entry, no fingerprint stored client-side — no consent requirement under this law. There is nothing to consent to.

The GDPR governs the data

Clearing the storage question does not end the analysis. If your tool processes personal data, the GDPR applies whether or not anything was stored on the device — and an IP address is personal data. The Court of Justice settled that in Breyer (C-582/14): a dynamic IP is personal data in the hands of someone who has legal means to identify the subscriber behind it.

The GDPR, however, does not demand consent for everything. It offers six lawful bases, and Article 6(1)(f) — legitimate interests — is available for analytics where the processing is proportionate and the visitor would reasonably expect it. That is precisely the basis a cookieless, aggregate-only tool is designed to sit on.

The practical test

For a given analytics tool, work down this list. The first “yes” means you need a consent banner.

• Does it set a cookie? Any cookie, including a first-party one. Yes means consent, under ePrivacy.
• Does it write to localStorage, sessionStorage or IndexedDB? Same rule. The directive says “information stored on the terminal equipment,” not “cookies.” Swapping the storage mechanism changes nothing legally, which is a trap several “cookieless” vendors fall into.
• Does it store a raw IP address, ever? Personal data under Breyer. You may still be able to rely on legitimate interests, but you owe a balancing test, a retention period, and a privacy notice entry.
• Does it build a cross-site or persistent profile? If the same identifier follows someone across sites or across weeks, you are past what legitimate interests will comfortably carry.
• Does it send data to a third country without safeguards? A separate Chapter V problem, and the reason several EU regulators ruled against Google Analytics in 2022 — Austria, France and Italy each found the transfers unlawful as configured at the time.

Checking your own site in one minute

Do not take a vendor's marketing page at face value, including ours. Open your site in a private window, accept nothing, and look.

// Open the console on your own site and run this.
// Anything listed here is a cookie you are responsible for.
document.cookie.split(";").map((c) => c.trim().split("=")[0]);

// Google Analytics 4 typically leaves: _ga, _ga_<container-id>

Then open DevTools → Application → Storage and check Local Storage and Session Storage for the tool's keys. A tool that calls itself cookieless while writing a visitor ID to localStorage has solved a marketing problem, not a legal one.

How measurement works without storage

The objection is reasonable: if you store nothing, how do you know whether two pageviews are one person or two? The answer is that you derive a value instead of storing one, and you make it expire by construction.

visitorHash = sha256(ip + userAgent + siteId + dailySalt)

// dailySalt is regenerated every 24 hours and the old one is destroyed.
// Yesterday's hashes cannot be recomputed, so the same person is a
// different value tomorrow — and no value maps back to an IP address.

Within a day, the same visitor produces the same hash, so sessions and unique visitors are countable. Across days, the salt has rotated and the old one is gone, so nobody — including us — can link today's activity to yesterday's. The trade is real and worth stating plainly: you lose true cross-day cohorts and individual user journeys. You keep every number most sites actually use.

What a banner actually costs you

The legal question has a measurement consequence that gets discussed far less. Every visitor who declines, or who closes the banner without answering, is a visitor your analytics never sees.

Published consent rates vary widely by geography and by banner design, and anyone quoting you a single universal figure is guessing. What is not in dispute is the direction: a meaningful share of European traffic does not opt in, those sessions are missing from your reports entirely, and they are not missing at random. Privacy-conscious and technical visitors decline more often, so the traffic you lose is skewed, not just smaller.

That is the part worth sitting with. A 30% decline rate does not mean your numbers are 30% low — it means your conversion rates, your channel mix and your device split are all computed on a non-representative sample, and you have no way to correct for it.

The short version

• Cookie banners come from ePrivacy Article 5(3), which is about storing things on a device — not from the GDPR.
• A tool that writes nothing to the device does not trigger that rule. localStorage counts as writing.
• The GDPR still applies to any personal data you process, but analytics can often rest on legitimate interests rather than consent.
• Check your own site rather than trusting a claim. It takes a minute.
• Banners are not only a compliance cost — they put a hole in your data that no amount of analysis repairs.

If you want measurement with no banner in the path, Quantalog takes about three minutes to wire up and the free plan does not ask for a card.