Do I need a cookie banner for analytics?

This is one of the most common questions from site owners, and the answer is more practical than it sounds: it depends almost entirely on whether your analytics tool stores information on the visitor's device. If it sets cookies or persistent identifiers, you usually need consent in the EU and UK. If it is genuinely cookie-free and stores nothing on the device, a banner is generally not required for the tracking itself. Everything else is detail.

None of this is legal advice, and the rules differ by jurisdiction and by how your site is set up. But the technical distinction is concrete, and understanding it lets you ask the right questions of any tool — and of your lawyer, if you have one.

What actually triggers a consent requirement

The trigger is storing or accessing information on a user's device, or processing personal data, unless that storage is strictly necessary to provide the service the user asked for. An analytics cookie is a classic example of storage that is not strictly necessary: the visitor did not need it to view the page, and it exists to recognise them later. That is why traditional analytics generally sits behind a consent banner.

Cookie-free analytics flips this. If nothing is written to the browser and no persistent identifier is created, there is nothing to consent to on the device side. Many such tools still compute a short-lived, rotating hash on the server so they can tell a new visit from a repeat view within a short window. That hash is not stored in the browser and is not used to follow the visitor afterwards.

Why banners hurt your data

A banner does not just add friction; it changes the numbers. Some visitors decline, some ignore the banner, and some block analytics entirely. The people who remain are not a random sample — they skew towards the least privacy-sensitive visitors and away from the most cautious. So a cookie-based tool that needs consent is quietly measuring a subset of your audience, while a cookie-free tool measures almost everyone who loads the page.

What you can still measure without cookies

Quite a lot, as it turns out. The questions most site owners actually ask do not require a persistent identifier:

• How many people visited, and which pages they read.
• Where they came from — referrers and UTM campaigns.
• What device, browser, screen size and language they used.
• How fast the page loaded, including Core Web Vitals.
• What actions they took — signups, clicks, downloads and custom events.
• Whether a visit is new or repeat within a short window, using a rotating server-side hash.

The honest grey areas

Cookie-free does not automatically mean zero obligations. If a tool processes personal data in some other way, or if you combine analytics data with other identifiers yourself, the picture gets more complicated. Data-protection authorities have also scrutinised server-side fingerprinting, so it is worth choosing a tool that is explicit about what it collects and why. The strongest position is a tool that collects no personal data, is transparent about its hashing window and publishes a data-processing agreement you can sign.

There is also the question of what your visitors expect. Even where a banner is not legally required, good practice is to mention analytics in your privacy policy, explain that it is cookie-free and link to the tool's documentation. Transparency is cheap, and it builds trust with exactly the visitors who care about privacy enough to read the policy.

A practical checklist

• Ask the vendor directly: does your script set cookies or write to local storage?
• Confirm whether a persistent identifier is created and how long it lives.
• Check whether the vendor offers a data-processing agreement.
• Update your privacy policy to name the tool and describe what it collects.
• If you are unsure about your jurisdiction, get a short legal review rather than guessing.

The short version: cookie-based analytics generally needs a banner; genuinely cookie-free analytics generally does not, for the tracking itself. If the goal is complete data without nagging every visitor, choose a tool that stores nothing on the device and be transparent about it in your policy.

What about consent mode?

You may have heard that consent mode solves the banner problem. It does not. Consent mode lets a tool like Google Analytics model conversions and traffic when consent is denied, by sending cookieless pings and estimating the missing data. That reduces the size of the gap and keeps advertising measurement roughly intact, but it is still a consent-based system: the banner remains, a share of visitors still decline, and the modelled numbers are estimates rather than counts. It is a useful improvement over losing that traffic entirely, and it is not the same as a genuinely cookie-free tool that never needed the banner in the first place.

The practical difference is who you are measuring. With consent mode, you are measuring a mix of real opt-ins and statistical estimates. With a cookie-free tool, you are measuring the people who loaded the page, minus bots and blockers, with no modelling layer. Neither is perfect, and both require you to understand the method before quoting a number. If your reports feed decisions where precision under consent matters, be explicit about which kind of number you are looking at. A short note in your dashboard or report can save a lot of confused conversations later. The simplest habit is to label every report with the tool and the method it came from, so nobody compares a modelled consent-mode figure to a direct count and concludes the site suddenly lost half its visitors. If you switch tools, expect a step change in the numbers and explain it before someone panics. Measurement is only useful when the people reading it understand what it does and does not represent. Write that down once, reuse it everywhere, and your reports become far easier to trust across tools and over time.