Privacy-Friendly Website Analytics Without a Cookie Banner?

Short answer: Sometimes, but "no cookies" doesn't automatically mean "no consent." The EU ePrivacy rule covers any reading of information from a visitor's device, and the EDPB's 2024 guidelines say that includes pixels, scripts sending device data and even IP-based tracking in many cases. What lets you skip consent is an exemption: France's CNIL, for example, exempts audience measurement used only by the site owner to produce anonymous statistics, with no cross-site tracking and no sharing for the vendor's own use. Configure analytics to fit those conditions and many EU sites can measure traffic without a banner.

Why "cookieless" isn't the test

Article 5(3) of the ePrivacy Directive, implemented in every EU country, requires consent for storing information on, or accessing information from, a user's device unless an exemption applies. It's technology-neutral.

The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form in October 2024, make this explicit. They cover URL and pixel tracking, local processing, tracking based on IP only, and unique identifiers. Two points matter for analytics:

When JavaScript instructs the browser to send information back to a server, that's "gaining access" within Article 5(3), even if nothing is stored.
IP-only tracking can fall under Article 5(3) too, unless the entity can be sure the IP address doesn't originate from the user's equipment.

The EDPB adds that Article 5(3) applying "does not systematically mean that consent needs to be collected"; an exemption may apply. So the real question is: does your analytics setup qualify for an exemption where your visitors are?

The exemption, using France's CNIL as the clearest example

The CNIL's page on audience measurement (updated July 2025) sets out when such trackers can be exempt from consent under French law. They must:

be used for a purpose strictly limited to measuring the site's or app's audience (performance, navigation problems, technical optimisation, server capacity, content analysis), for the publisher's sole benefit;
produce anonymous statistical data only.

They must not:

lead to data being combined with other processing, or non-anonymous data being passed to third parties;
allow tracking of a person across different apps or websites. Any solution using the same identifier across several sites is excluded.

The CNIL also recommends telling users (for example in the privacy policy), limiting tracker lifetime to around 13 months without automatic extension, keeping collected data for no more than 25 months, and reviewing those periods regularly. It warns that some analytics offers fall outside the exemption because the provider reuses the data for its own purposes, though some can be configured to switch that off, and that you should watch for data transfers outside the EU.

Other regulators take similar but not identical lines. The Dutch law, for instance, has its own exemption for low-impact analytics. Check the regulator for each country you mainly serve.

Comparison: what you get with each approach

Approach	Consent needed in the EU?	What you see	What you lose
GA4 with default settings, ads features on	Generally yes	Full funnels, audiences, Google Ads integration, cross-device signals	Data from everyone who rejects; banner friction
GA4 behind consent, consent mode	Yes, for those who accept	Detailed data for consenting users, modelled estimates for others	Accuracy depends on modelling; complex setup
Self-hosted or EU analytics configured for anonymous, first-party statistics	Often no, if it fits the national exemption	Pageviews, sources, top pages, devices, countries, goal counts	User-level journeys, remarketing audiences, cross-site data
Cookieless tools using daily-rotating hashes	Often no, if configured within the exemption	Unique visitors per day, sources, pages, conversions	Returning-visitor analysis across days, long funnels
Server log analysis	Usually outside Article 5(3) if nothing extra is read from the device	Requests, bots, errors, rough traffic	Marketing attribution, events in the browser

An example of how a cookieless tool works: Plausible's data policy says it uses no cookies, browser cache or local storage and creates a daily identifier by hashing a salt plus the site domain, IP address and user agent; the salt "is rotated and deleted every 24 hours," and raw IP addresses aren't stored. That design stops cross-day tracking, which is exactly the kind of property regulators look for. Vendor claims are a starting point, though; you're responsible for checking the configuration against your regulator's conditions.

What you really give up compared with GA4

Ad platform integration. No remarketing audiences or automated bidding signals from analytics.
Long user journeys. With daily identifiers, "visited three times before buying" disappears.
Detailed demographics and interests.
Some precision. Without persistent IDs, unique visitor counts are estimates over the period.

For most small business sites, the questions that matter are simpler: which pages bring enquiries, where visitors come from, and whether a campaign worked. Privacy-friendly tools answer those well.

Setup advice

Decide what you actually need to know. Write five questions you'd act on. If none requires user-level tracking, you don't need it.
Pick a tool that can run as first-party, anonymous measurement, preferably hosted in the EU, with data reuse by the vendor switched off.
Configure for the exemption: no cross-site identifiers, no user IDs, truncated or hashed IPs, short identifier lifetimes, retention within your regulator's guidance.
Sign a processing agreement with the vendor and list it in your privacy policy.
Tell visitors. Even exempt analytics need information, usually a short section in your privacy or cookie policy.
Keep everything else behind consent. Ad pixels, social embeds and heatmaps with session recording still need it. Exempt analytics only removes the banner if they were the only reason for it.
Run a real check. Load your site in a private window and confirm no other trackers fire. Regulators do the same: the Dutch AP, for example, said in 2025 that it monitors 10,000 websites and flags banners that place cookies before consent.

FAQ

Can I use Google Analytics without consent if I anonymise IPs?

Generally not with a standard setup, because the vendor's own use of data, cross-site identifiers and advertising features take it outside the exemptions regulators describe. Some regulators have examined specific configurations; if GA4 matters to you, keep it behind consent.

Do server logs need consent?

Logs your server writes from requests it receives anyway don't usually involve accessing extra information on the device. Analysing them for security and basic statistics is common, but logs still contain personal data such as IP addresses, so the GDPR applies to how long you keep them.

Is the CNIL's exemption valid in Germany or Spain?

It's French guidance. Other regulators apply the same EU rule but may set different conditions. Use it as a strong reference, then check the regulator where most of your visitors are.

Will dropping the banner improve my conversion rate?

It removes a step from every first visit, which helps mobile visitors especially. Measure before and after with the same tool so the comparison is fair.

If you'd like analytics that answer your real questions without a consent wall, tell us what you need to measure.