Analytics without a cookie banner.

Whether you need a banner depends on what a tool stores or reads on the visitor's device, what it does with the data, and who else gets it. Having no cookies helps but does not settle it. France and the UK both let simple, limited analytics run without consent, on conditions. Ad pixels, Google Analytics and some embeds still need a banner. Ask a lawyer about your own site.

• Consent first

  is the EU rule. Storing information on someone's device, or reading information already stored there, is only allowed with their consent. The exceptions are sending a message over a network, and what is strictly necessary for a service the visitor asked for. European Union

• Not only cookies

  is how the European Data Protection Board reads it. Its 2024 guidelines say the rule also covers similar technologies, and they name tracking pixels, tracking links and tracking built on the IP address alone. So a tool with no cookies can still fall under it. European Data Protection Board

• Not always consent

  is the same document's reminder. It says the rule applying to a technique does not mean consent is always needed, because an exception may apply. European Data Protection Board

• 13 months

  is the longest a tracker may live under France's analytics exemption. The same exemption also needs the last byte of the IP address cut off, a single site only, a limit to audience measurement and A/B testing, and no mixing with other data. People must be told and be able to object. CNIL (France)

• 4 main conditions

  sit in the UK's new exception for statistics. The only purpose is counting how the service is used, to improve it. The data is not shared except with someone helping to improve it. People get clear information. People get a free, simple way to object. UK Parliament

• 5 February 2026

  is when that UK exception came into force. The Information Commissioner's Office finalised its guidance on it in April 2026. As of October 2026 it is in force. UK Parliament

• Any online identifier

  can make data personal under the GDPR. The law lists IP addresses and cookie identifiers as examples. This applies whether or not a banner is needed. European Union

1. 01An ad pixel is on the site

   A tracking pixel is an image or script whose only job is to make the visitor's browser report back to another company. The European Data Protection Board says this counts under the consent rule even when no cookie is set. The UK exception only covers statistics used to improve your own site, shared with no one except someone helping you do that. A pixel exists to send data to an ad company. European Data Protection Board

   TRY THISIf you do not run ads, remove the pixel. If you do, load it only after someone presses accept, and keep it out of the pages where you only count visits.

2. 02Google Analytics is still installed

   Google's own documentation says its tags set and read cookies to identify unique users across visits. That is the stored identifier the consent rule is about, so the banner stays as long as the tag does. Google for Developers

   TRY THISCheck whether you read anything beyond page counts and sources. If not, swap it for a tool that stores nothing on the device, then take the old tag out of every page. Removing it from the settings alone does not remove it from the code.

3. 03An embed or widget stores something of its own

   A video player, a chat bubble or a map is another company's code running on your page. Whether it stores or reads anything on the visitor's device depends on the widget. The rule applies to it the same way as to your analytics. European Union

   TRY THISOpen your site in a private window, open the browser's storage panel, and see what appears before you press anything. For each item you do not need, swap the embed for a link or a picture that loads the player on click.

4. 04The tool says cookieless, and nobody checked what it reads

   The word cookieless describes one technique. The European Data Protection Board says a script that tells the browser to send information back counts as gaining access to the device, even when the information is made on the spot. Whether that needs consent is then a question of which exception fits. European Data Protection Board

   TRY THISAsk the vendor three things in writing: what is stored on the device, what the script reads and sends, and whether any of it goes to anyone else. Keep the answer with your records.

5. 05The data is used for more than counting

   Both exemptions are narrow. France's needs the tool kept to audience measurement and A/B testing and the data kept apart from other files. The UK's does not cover tracking or profiling people, or using the data to target content to groups of visitors. CNIL (France)

   TRY THISKeep analytics to counts of visits, pages and forms. Do not join it to your customer list or your ad accounts.

6. 06No cookie was taken to mean no personal data

   The GDPR defines personal data by whether a person can be identified, and it names IP addresses as an example. A banner is about the device. The GDPR is about the data. You can need neither, one or both. European Union

   TRY THISWrite down what your tool keeps about a visit, for how long, and who handles it. If you are in the EU or UK, ask the vendor for a data processing agreement.