Cookieless Analytics and GDPR: When You Can Drop the Cookie Banner (2026)

Disclosure first: I run Trafnova, a cookieless analytics tool, so I have a horse in this race. The legal mechanics below apply to every tool in the category (Plausible, Fathom, Simple Analytics, mine, others), and I'll flag the points where vendors, including me, tend to oversimplify.

Second disclaimer: I'm an operator, not a lawyer. This is the working understanding I run my own sites on, with sources you can hand to whoever signs off on compliance at your company.

Why the banner exists at all

Two separate European rules get mashed together under "GDPR" in most conversations:

1. The ePrivacy Directive (the actual "cookie law", from 2002, amended 2009). It says you need consent before storing anything on, or reading anything from, a visitor's device, unless the storage is strictly necessary for the service the visitor asked for. This covers cookies, localStorage, fingerprinting via stored identifiers. What trips it is storage access, regardless of whether anyone would call the thing "tracking".
2. GDPR (2018). It governs processing of personal data, defined broadly: anything that can identify a person directly or indirectly, including IP addresses and unique identifiers. If you process personal data, you need a legal basis: consent, legitimate interest, contract, and so on.

Google Analytics trips both wires. It sets cookies (_ga, _gid) with persistent client IDs, which is ePrivacy territory, and those IDs plus IP addresses are personal data, which is GDPR territory. Hence the banner: it's there to collect the consent that makes both legal.

The logic runs in reverse too, and that's the point of this post. A tool that stores nothing on the device sidesteps the ePrivacy consent requirement. A tool that keeps no data capable of identifying anyone weakens the GDPR hook as well. No wire tripped, no consent needed, no banner for the analytics part.

How cookieless analytics counts visitors

The standard mechanism in this category (Plausible documented it first and most thoroughly, Fathom and others use variations, Trafnova works the same way) is a daily-rotating hash:

visitor_id = hash(daily_random_salt + site_id + ip_address + user_agent)

Per request, the server computes this hash, uses it to decide "same visitor as the last hit or a new one", and stores only the hash. The components matter:

• Nothing is stored on the device. No cookie, no localStorage entry, nothing read back. The ePrivacy storage trigger never fires.
• The salt rotates every day and the old salt is discarded. Yesterday's hashes can't be recomputed or linked to today's. A visitor who comes back tomorrow is, mathematically, a brand new visitor.
• The raw IP and user agent are used in memory for the hash, then dropped. What sits in the database can't be reversed into an IP address, and without the discarded salt it can't even be re-derived from a known IP.

What this buys you: unique visitor counts within a day, session and bounce metrics, page-by-page traffic, referrers, country-level geography. What it costs you is covered below, and it's not nothing.

What the regulators have said

This is the part to actually forward to your DPO rather than paraphrase:

• CNIL (France) maintains a published exemption from the consent requirement for audience-measurement tools, provided they meet strict conditions: the analytics serve only the operator, no cross-site tracking, no personal-data linkage, limited retention. CNIL keeps a list of conditions (and has historically named specific configurations of specific tools as qualifying). The exemption is the clearest written statement from an EU regulator that analytics-without-consent can be a legal configuration.
• ICO (UK) has indicated that low-risk, first-party audience measurement is at the bottom of its enforcement priorities and has publicly discussed exempting it from the UK's consent rules. The UK's post-Brexit data reform explicitly moved in this direction.
• The GA-specific decisions (Schrems II fallout). Between 2022 and 2023, the Austrian, French, and Italian DPAs each ruled that Google Analytics, as then configured, illegally transferred EU personal data to the US. Those rulings are why "GA4 is illegal in Europe" headlines exist. The EU-US Data Privacy Framework (2023) patched the transfer problem for certified companies, but the rulings established the premise that analytics identifiers plus IP are personal data, which is exactly the data a cookieless tool declines to keep.

None of this adds up to "the EU approved tool X". The claim is narrower: a tool that stores nothing on the device and retains no identifying data fits inside an exemption that regulators have described in writing.

What you give up

Vendors in this category (again, including me) like to present cookieless as a free lunch. It isn't. The daily salt rotation has real analytical costs:

You lose	Why	Does it matter?
Returning-visitor rate across days	Tomorrow's hash can't match today's	If "% returning" drives decisions, yes
Retention cohorts ("of March signups, how many came back in April")	Same	For content sites, rarely. For products, use your app's own auth data instead
Cross-device journeys	Phone and laptop hash differently	GA barely did this well anyway without login data
User-level funnels spanning multiple days	A 3-day consideration funnel looks like 3 anonymous visitors	Single-session funnels still work
Ad-platform remarketing audiences	No persistent ID to sync	This is the one that breaks marketing workflows. If you run remarketing, you need consented pixels regardless, see below

A same-day visitor returning at lunch and again at dinner still counts once. A weekly-habit reader counts once per day. For "how is my content doing, where does traffic come from, what spiked", which is the everyday use of analytics, the daily horizon costs you almost nothing.

When you still need a banner

Removing GA removes GA's consent requirement. It doesn't bless the rest of your script tag collection. You still need consent UI if any of these are on the page:

• Facebook/Meta Pixel, TikTok Pixel, LinkedIn Insight Tag. All set identifiers and do cross-site matching. All need consent.
• Google Ads conversion tracking and remarketing tags. Consent Mode exists precisely because these need consent in the EU.
• Embedded YouTube videos, Google Maps, social widgets in their default configurations. They set their own cookies. (YouTube has a youtube-nocookie.com embed domain that helps.)
• Session recording and heatmap tools (Hotjar, Clarity, FullStory). They capture behavior at a level most DPAs treat as personal data.
• A/B testing tools that persist a variant assignment in a cookie or localStorage. The storage trigger fires even if no data leaves the device, though "strictly necessary" arguments exist for some configurations.
• Login systems, carts, CSRF tokens are fine without consent: they're "strictly necessary" for the service the user requested. That's the ePrivacy carve-out working as intended.

Cookieless analytics removes the analytics line from your consent audit, nothing more. If analytics was the only third-party script you ran, the banner can go entirely, and that's a real conversion-rate win (consent-banner drop-off estimates run 5-25% depending on design). If you run a marketing stack, the banner stays and shrinks.

Verifying a vendor's claim

Any tool claiming "no banner needed" should survive this five-minute audit. Open DevTools on a page where the tracker runs:

1. Application tab, Cookies. Filter by the tracker's domain. There should be zero cookies, before any consent interaction.
2. Application tab, Local Storage and Session Storage. Same: nothing written by the tracker. (An explicit opt-out flag the visitor sets is fine; that's storage the user asked for.)
3. Network tab. Look at the tracker's POST payload. It should contain the URL, referrer, and screen-class data, with no client ID that survives a browser restart. Restart the browser and compare: if an identifier persists, it's stored somewhere, and claim #1 or #2 was false.
4. Ask where the salt-rotation or equivalent de-identification is documented. Plausible, Fathom, and Simple Analytics all publish their data policy mechanics. (Trafnova's is on the tracking docs page.) A vendor that can't point to a written mechanism is asking you to take marketing copy on faith.
5. Check data residency if EU-only processing matters to your DPO. Several tools in the category offer EU-hosted or EU-isolated options.

Picking a tool

I keep a maintained comparison of Plausible, Fathom, and Matomo and a wider list of Google Analytics alternatives, so I won't duplicate the tables here. The short version for this post's angle:

• Plausible and Fathom are cookieless by default. No configuration, banner-free analytics out of the box.
• Matomo can run cookieless but doesn't default to it. Out of the box it sets first-party cookies and needs a banner. If you pick Matomo for its feature depth, budget the config time and re-run the DevTools audit above afterward.
• Self-hosting (Matomo, Umami, Plausible CE) adds data-controller cleanliness: the data never leaves infrastructure you control, which simplifies the GDPR processor conversation to zero.
• Trafnova is cookieless on the same daily-hash model; the niche is operators running many sites who want one morning digest instead of N dashboards. Single-site operators are better served by the tools above.

Already decided to move? The migration guide covers the parallel-run sequence, history export, and the validation step where the new numbers won't match GA's (they shouldn't; GA was counting bots and losing consent-declined visitors).

FAQ

Is IP-based hashing itself "processing personal data" under GDPR? Momentarily, yes: the IP exists in memory during hash computation. The position taken across the category (and consistent with CNIL's exemption conditions) is that immediate, irreversible de-identification with no retention of the raw input is either outside GDPR's scope after the instant of processing, or safely covered by legitimate interest for audience measurement. This is the most technical point in the whole debate, and it's the one to put in front of an EU privacy lawyer if your audit needs to be airtight rather than reasonable.

Do I still need a privacy policy? Yes. A privacy policy describes your processing, banner or no banner. List the analytics tool, what it collects, retention, where data lives. The banner goes; the disclosure stays.

Does Do Not Track / Global Privacy Control matter here? Legally, GPC has teeth in California (CCPA/CPRA), not in the EU. In practice, most tools in this category honor DNT or GPC voluntarily. Trafnova's tracker respects navigator.doNotTrack, and a visitor-level opt-out is documented in the tracking docs.

What about Google Consent Mode v2: doesn't it make GA legal without a banner? No. Consent Mode is a protocol for telling Google's tags what the visitor consented to. Denied consent means GA4 drops to cookieless pings and modeled conversions. You still need the banner to collect the consent signal; Consent Mode just changes what happens after the click.

Can I be fined for getting this wrong? The realistic enforcement gradient: DPAs have fined GA users over transfers (the Schrems II cases) and fined large platforms over dark-pattern banners. Enforcement against a small operator running a CNIL-exemption-shaped analytics tool with no other trackers is, as of 2026, not a thing that has happened. That's an observation about enforcement priorities, not legal advice.

If cookieless data is anonymous, can I keep it forever? Anonymized data sits outside GDPR's retention rules, so legally you have room. Practically, your own storage bill and the declining usefulness of stale paths argue for a retention window anyway. Check what your vendor does by default; "we keep aggregates indefinitely, raw events for N months" is a common and defensible shape.