Analytics without cookies: what changes and what does not

"Cookieless analytics" is often sold as the end of the consent banner. Removing cookies does change a lot: no third-party tracking, nothing that follows people between sites, far less personal data. But the rules that made banners common in Europe were never only about cookies, and a tool that stores anything on the visitor's device can still fall under them. This article covers what dropping cookies changes, what it does not, and what to check for your own site.

This is not legal advice. The rules differ between countries and are read differently by different regulators; for a decision about your site, ask someone qualified where you and your visitors are.

What a cookie was doing in analytics

Traditional web analytics sets a cookie holding an identifier, so that a returning visitor is recognised as the same person. Google Analytics 4, for example, sets a _ga cookie "used to distinguish users" and a _ga_<container-id> cookie "used to persist session state", each expiring after two years by default (Google: cookie usage).

The identifier is what lets a tool count unique visitors, sessions and returning visitors. Take the cookie away and the tool needs another way to do those things, or does without them.

What tools do instead

There are broadly three approaches:

1. Another kind of browser storage. The identifier lives in localStorage or similar instead of a cookie. Counting works as before; nothing is sent with every request to the site, and nothing is shared with other sites.
2. No stored identifier at all. Each request is counted on its own, and unique visitors are estimated, for example from a value derived from the request that changes every day. Nothing is stored on the device, but deriving a value from the IP address and browser is still processing information about the visitor, and estimates are less precise.
3. No visitor counting. Only page views and events are counted, never people. Simple and private, but it cannot answer "how many people" or "do they come back".

Each is a real improvement over a cross-site tracking cookie. None of them is automatically "exempt" from anything.

What does not change: the rule is about storage, not cookies

In the European Union, the rule behind cookie banners is Article 5(3) of the ePrivacy Directive. It says, in substance, that storing information on a person's device, or reading information already stored there, needs their consent, unless it is strictly necessary to provide a service they asked for, or to carry out the transmission of a communication (EUR-Lex: Directive 2002/58/EC).

The rule does not mention cookies by name. The European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3), adopted in their final version on 16 October 2024, explain how far it reaches beyond them, to other ways of storing or reading information on a device.

So an identifier kept in localStorage is still information stored on the visitor's device. Moving it out of a cookie does not, by itself, take it outside the rule.

Where exemptions exist

Analytics is not usually "strictly necessary" for a site to work, so it generally needs consent under that rule. Some regulators have carved out an exemption for audience measurement that meets strict conditions. France's regulator, the CNIL, exempts audience measurement trackers from consent when, among other conditions, their purpose is limited to audience measurement and A/B testing, they are limited to a single site or application, visitors can object to them, and their lifetime is capped at 13 months. It also warns that "most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration" (CNIL: use analytics on your websites and applications).

Not every country has such an exemption, and those that do word it differently. Whether a banner can go depends on where your visitors are and how their regulator reads the rule, not on the word "cookieless".

What dropping cookies does change

Even where consent is still needed, a tool without cookies, cross-site identifiers or personal data is a different proposition:

• Nothing follows visitors between sites. No third-party cookies, no shared identifiers.
• Far less personal data. Without names, emails or fingerprints, there is little to protect and little to disclose.
• A much easier conversation with a regulator, and a much shorter privacy notice.
• A real chance at an exemption where one exists, because the conditions are built around exactly this kind of narrow, single-site measurement.

What to check for your own site

1. What does the tool store or read on the device? Cookies, localStorage, anything else.
2. What does it send, and what does it keep? IP addresses, page addresses with query strings, anything typed.
3. Is anything shared beyond your site? Identifiers, advertising networks, other customers.
4. Can visitors object, and does the tool honour signals such as Global Privacy Control?
5. Where are your visitors, and what does their regulator say about audience measurement?

Then decide, with advice if you need it, whether you ask for consent, rely on an exemption, or change the tool.

Common questions

Does hashing the IP address make it anonymous?

Not necessarily. A value worked out from an IP address and a browser, even one that changes every day, is still derived from information about the visitor, and data protection rules can still treat that as processing personal data. It is better than storing the address; it is not the same as never having it.

What about visitors outside Europe?

Other places have their own rules, often aimed at selling or sharing data for advertising rather than at device storage. A tool that collects little and shares nothing tends to fit most of them, but check the rules where your visitors are.

Does the same apply to browser extensions?

Information an extension stores on the device is still stored on the device. Firefox's built-in consent is a consent mechanism for extensions' data collection, and the stores ask you to declare what you collect; see Passing Firefox add-on review with analytics.

Should I keep a banner just in case?

That is a decision about risk, best made with advice. If you keep one, make declining as easy as accepting, and make sure your tool really sends nothing when someone declines.

How AnalyticsTrend does it

AnalyticsTrend sets no cookies on the people it measures. On a website, its SDK keeps a random identifier in the site's own browser storage, scoped to that site alone, so returning visitors can be counted; it is not derived from anything about the device or the person. The IP address is turned into a country, and in some countries a region, then discarded. A browser that sends Global Privacy Control is not counted at all, unless you turn that off.

That identifier is still something stored on the visitor's device. Whether your use of it needs consent depends on where you and your visitors are, so check what applies to you. What AnalyticsTrend stores and sends is listed in What it collects; the website setup is in Install on a website. For the practices behind it, see What privacy-respecting analytics means.

---

Checked against the sources linked above on 7 October 2026.