Almost every cookie banner on the web exists for one reason: the site measures its traffic with a tool that stores an identifier in the browser. Remove the storage and, in most cases, the banner has nothing left to ask about.
That sentence does a lot of work, and it is worth unpacking carefully — because "you don't need consent" is repeated far more often than it is explained, and the explanation is what tells you whether it applies to your site.
Two different laws, doing two different jobs
The confusion starts here. People say "GDPR banner", but the banner is usually not a GDPR requirement at all. Two separate instruments are in play.
The ePrivacy Directive — article 5(3), implemented in national law across the EU and mirrored by the UK's PECR — governs storing information on, or gaining access to information stored on, a user's terminal equipment. It is technology-neutral: it says nothing about cookies specifically. Local storage, session storage, an IndexedDB entry, a device fingerprint assembled by probing the browser — all of it is caught. Strictly necessary storage is exempt; analytics is not considered strictly necessary by most regulators.
The GDPR governs the processing of personal data, whatever the source. It does not require a banner. It requires a lawful basis, and consent is only one of six.
The practical consequence is the part that matters: the banner is triggered by the storage, and the storage is what conventional analytics does first. If nothing is written to the device, article 5(3) has nothing to attach to, and you are left with the GDPR question alone — which can often be answered with legitimate interests rather than consent.
What "cookieless" has to mean to be worth anything
The word is used loosely enough to be almost meaningless, so here is the test. A tool is only genuinely outside article 5(3) if it:
- writes no cookie, and no local storage, session storage or IndexedDB entry;
- performs no fingerprinting — no canvas rendering, no font enumeration, no audio context probing, no reading of the device's screen and hardware profile to assemble an identifier;
- does not read anything already stored on the device for identification purposes.
That last one catches tools that avoid setting anything but read what is already there. Reading is regulated exactly as writing is.
If a vendor calls itself cookieless but derives a stable identifier by measuring the device, it has replaced regulated storage with regulated access. The banner comes back — and this time it is harder to justify, because a fingerprint is more invasive than the cookie it replaced.
So how does anything count visitors without storage?
By computing an identifier that lives only for the length of a request and is never written down anywhere. The mechanics are worth understanding before you rely on them, but the short version: hash the IP address and user-agent together with a secret that changes every day and is different for every site, use the result to stitch that day's pageviews into sessions, and discard the inputs.
Within a day, the same person produces the same identifier, so sessions and visitor counts are real. The next day the salt has rotated and the same person is unrecognisable — deliberately. Nothing was stored on the device and nothing identifying was stored on the server.
The trade is honest and worth stating plainly: you lose cross-day identity. A visitor who returns on Tuesday and Thursday counts as two daily visitors, not one returning one. That is the price of not needing a banner, and it is a price that shows up as numbers that differ from Google Analytics.
Where an IP address fits
The IP address is personal data under the GDPR. That is settled, and it does not depend on whether you can identify the person yourself.
But there is a difference between processing an IP address transiently and storing one. Using an address as the input to a one-way hash, and never writing it to disk, is processing. It needs a lawful basis under the GDPR — legitimate interests is the usual one, documented in a legitimate interests assessment — and it does not trigger the ePrivacy consent rule, because nothing was placed on or read from the device.
Regulators have accepted this reasoning for privacy-preserving measurement. The CNIL in France, for instance, publishes conditions under which analytics can be exempted from consent, and they are broadly the conditions described here: no cross-site tracking, no fine-grained location, data used only for the site's own aggregate statistics.
What you still owe your visitors
Dropping the banner does not drop the obligations. Even with no storage at all, you should:
- Say what you measure, in plain language, on a page anyone can reach. Not a legal document — a description of the actual behaviour.
- Name your lawful basis for processing the IP address transiently, and write down the assessment behind it.
- Keep the data where you said it would be. A tool that sends measurements to a third party's servers has a transfer to justify, including possibly an international one.
- Honour an opt-out anyway. Not because a law compels it, but because a measurement system that cannot be refused is a system that will eventually be blocked wholesale.
The part nobody says out loud
Banners are expensive in a way that never appears on an invoice. Somewhere between a fifth and a half of visitors decline or ignore them, and every one of those is a visitor your analytics cannot see. You are then making decisions from a sample that is not random — it is biased toward the people most willing to accept tracking, which is exactly the group least representative of the rest.
Removing the banner is not only a compliance decision. It is the difference between measuring most of your traffic and measuring the compliant fraction of it.
A short checklist
- Does the tool write anything to the device? If yes, you need consent.
- Does it read the device to build an identifier? If yes, you need consent.
- Does it send data to a third party who uses it for their own purposes? Then you have a controller relationship to work out, not just a banner.
- Can you describe, in one paragraph, exactly what is recorded? If not, neither can your privacy page.
None of this is legal advice, and a specific obligation deserves a specific answer from someone who has read your situation. But the architecture question — does this tool store anything on the device — is one you can answer yourself today, and it is the one the rest follows from.
Common questions
Is a cookie banner required by the GDPR?
No. The banner requirement comes from the ePrivacy Directive (article 5(3)) and its national implementations, which govern storing or accessing information on a user's device. The GDPR governs the processing of personal data and requires a lawful basis, which may be consent but may also be legitimate interests.
Does analytics without cookies still need consent?
If it stores nothing on the device and reads nothing from it — no cookie, no local storage, no fingerprinting — then the ePrivacy consent rule is not triggered. You still need a lawful basis under the GDPR for any personal data processed, such as the IP address used transiently to compute a hash, and legitimate interests is normally the appropriate basis.
Is fingerprinting an acceptable replacement for cookies?
No. Reading information from a device to build an identifier is covered by the same rule as writing to it, so fingerprinting requires consent just as a cookie does — and it is generally regarded as more invasive, because the visitor cannot clear it.
How much traffic does a consent banner hide from analytics?
It varies widely by audience and geography, but a substantial share of visitors decline or ignore banners. The measurement problem is not only the volume lost: the remaining sample is biased toward visitors who accept tracking, so the numbers are systematically unrepresentative rather than merely smaller.