Analytics Without a Cookie Banner: What You Can Legally Track

The cookie banner is the only interface element in history that every user hates, every designer resents, and every company ships anyway. It exists because of a specific legal chain, and that chain has a gap in it that most teams have never examined: the banner is required by what your analytics stores on the visitor's device, not by the act of measuring your website.

Change what the analytics stores, and the banner requirement changes with it. This post walks the actual legal line, what you can and cannot track without consent, and the part nobody talks about: the data you get without a banner is frequently better than the data you get with one.

The usual caveat applies. We build an analytics product, we have spent a long time in these rules, and none of this is legal advice for your specific setup. Your DPO gets the final word, and we wrote a companion piece on exactly what that review looks like.

Where the banner requirement actually comes from#

Two laws get blended together in most discussions, and separating them is the whole game.

The ePrivacy rules (the "cookie law") say you need consent before storing information on a user's device or reading information already stored there, unless it is strictly necessary to provide the service the user asked for. This is the law that creates the banner. Note what it regulates: storage and access on the device. Cookies, localStorage, and device fingerprinting workarounds. Not "analytics" as an activity.

GDPR governs the processing of personal data wherever it happens, and requires a lawful basis such as consent or legitimate interest. It applies to any measurement that touches personal data, banner or no banner.

Put together: a tool that sets an analytics cookie needs consent for the cookie under ePrivacy, full stop. A tool that stores nothing on the device never triggers that consent requirement, and its data processing can potentially rest on legitimate interest under GDPR instead of consent. Several EU regulators have published guidance along exactly these lines, with the French CNIL's audience-measurement exemption being the best-known example: analytics that is strictly scoped, produces only aggregate statistics, and tracks nobody across sites can run without consent.

That "strictly scoped" part is load-bearing, so let us make it concrete.

What you can measure with no banner#

An identifier-free analytics setup, meaning no cookies, no localStorage identifiers, no fingerprinting, can legitimately give you a surprising amount:

• Page views and content performance. Which pages get read, entry and exit pages, reading depth.
• Referrers and campaigns. Where visitors came from, including UTM-tagged campaign traffic, since the referrer and URL arrive with the request and require nothing stored on the device.
• Aggregate technology and geography. Browser family, device class, screen class, country and region derived from the request and then discarded or truncated.
• Sessions, funnels, and conversions. A visit can be followed through its steps using short-lived, session-scoped techniques that never persist an identifier to the device and never allow recognition across visits. This is the part people assume is impossible without cookies, and it is not. Our cookieless tracking explainer covers the mechanics in detail.
• Behavioral signals within a session. Scroll depth, dead clicks, rage clicks, form field abandonment. These describe what happened on your site during one visit, which is exactly the scope the strictest regulator guidance permits.

Read that list again as a product person rather than a lawyer. Pages, sources, campaigns, funnels, conversions, and friction signals. That is not a consolation prize. That is the substance of website analytics.

What you cannot do without consent#

The line sits where measurement turns into recognition. Without consent, you give up:

• Recognizing returning visitors across days. No persistent identifier means visitor number 4,012 on Tuesday cannot be linked to a visit on Friday. Metrics like "returning visitor rate" and true multi-day journeys need consent-based identity.
• Cross-site and cross-device tracking. Following a person from someone else's site to yours, or from their phone to their laptop, is exactly what the rules exist to prevent. This category also includes every third-party advertising pixel, which is why the marketing tags on your site still need a banner even if your analytics does not.
• Fingerprinting your way around the rules. Deriving a stable identifier from browser quirks is treated as equivalent to a cookie by regulators, because it reads information from the device to single a person out. A vendor whose "cookieless" pitch quietly rests on fingerprinting has moved the problem, not solved it.
• Long-term attribution windows. "This customer first arrived via that campaign nine months ago" requires remembering the person for nine months. Session-scoped analytics attributes within the visit.

Whether these losses matter depends entirely on what decisions you make with analytics. Teams optimizing their product and conversion funnels lose very little. Teams running multi-touch attribution models across quarters lose a lot, and they were going to need consent regardless.

The part nobody tells you: banner-free data is often better data#

Here is the trade as it actually plays out. Consent-based analytics measures the subset of visitors who click accept. Depending on your audience and how honest your banner is, the visitors who decline or ignore it can be a large share of your traffic, and they are not a random sample. Privacy-conscious users, mobile users in a hurry, and entire browsers with aggressive defaults fall out of your data. Google's own consent-mode approach responds to this by statistically modeling the missing visitors, meaning parts of your GA4 reports are inferred rather than observed. We measured how big that hole gets in the GA4 traffic gap.

Identifier-free measurement flips this. Because nothing needs consent under ePrivacy, every visit is measured. Your funnel is complete rather than sampled from the consenting, your conversion rates stop being estimates, and A/B test arms fill with real sessions. Trading multi-day visitor stitching for complete, unmodeled session data is, for most product and conversion work, a trade you win.

There is also the front-door effect, easy to underrate: your visitors' first interaction with your site stops being a legal dialog. For a business whose entire pitch is respecting users, the banner-free landing page is the pitch. It is why we and other European tools treat this as an architecture decision, not a settings toggle. The wider European movement around this is covered in our look at EU cookieless analytics in 2026.

The honest checklist before you drop the banner#

Removing the banner is a compliance decision, so do it deliberately:

1. Inventory every script on your site, not just analytics. The banner requirement is triggered by any non-essential storage. If ad pixels, embedded videos, or chat widgets set cookies, those still need consent even after your analytics no longer does.
2. Verify the vendor's architecture. Ask directly: is anything stored on the device, is any fingerprinting used, can a visitor be recognized across visits. Get it in writing. The answers should be no, no, and no.
3. Confirm the processing stays scoped. Aggregate statistics and single-site measurement. The moment data feeds advertising or cross-site profiles, the exemptions close.
4. Document your lawful basis. Under GDPR you still need one, typically legitimate interest, and a short legitimate-interest assessment in your records turns a future audit from an ordeal into an email.
5. Update the privacy policy. No banner does not mean no transparency. Say what you measure and why, in language a human can read.
6. Run it past your DPO. Member-state guidance differs in the details, and session replay in particular deserves its own review with input masking on by default.

Measurement was never the problem#

The last decade's privacy rules were never aimed at a site owner counting page views. They were aimed at persistent identification and cross-site surveillance, and analytics tools inherited the banner because they were built on the same cookies the surveillance used. Rebuild the measurement without the identifiers and the conflict mostly dissolves: users get a site that does not open with a legal form, regulators get the data minimization they asked for, and you get complete numbers.

GrainQL was built on that premise from the first line of code: cookieless, identifier-free, hosted in the EU, with heatmaps, funnels, session replay, and an AI analyst on top. If your current tool needs a banner to function, the question is no longer whether alternatives exist. It is whether you still need the banner.