Do you need a cookie banner for web analytics?

Short answer: with a cookie-free analytics tool you usually don't need a consent banner, but you still have to mention the analytics in your privacy policy. Those are two different laws, and mixing them up is the most common mistake we see.

This guide explains both, in plain language. It is not legal advice; for your specific case, ask a lawyer.

Two rules, two questions#

The banner comes from the first rule. The privacy policy comes from the second. A tool can avoid the first and still be subject to the second.

When analytics needs a banner#

Classic analytics (Google Analytics and most tag-based tools) sets cookies or uses localStorage to recognise returning visitors. Analytics cookies are not "strictly necessary" for the service the visitor asked for, so the cookie law requires prior consent, and in practice that means a banner.

Two side effects people forget:

• Your data becomes a sample. Only visitors who click "accept" are measured. Depending on the design of the banner and the audience, a large share of visitors may never be counted.
• The banner costs conversions. It is the first thing every visitor sees, on every device.

When you can skip the banner#

If the analytics script does not store or read anything on the device (no cookies, no localStorage, no fingerprinting), the cookie law is not triggered for that script, and in most cases no consent banner is required for it.

Two nuances to be honest about:

• The European Data Protection Board's Guidelines 2/2023 read "gaining access to the device" broadly, and some regulators may consider other techniques too. National guidance differs.
• Some regulators, such as the French CNIL, explicitly exempt audience measurement from consent when it meets strict conditions (first-party, aggregated, limited purpose).

That is why responsible vendors say "no banner in most cases", never "never".

What you still have to do under the GDPR#

Cookie-free analytics still sees the visitor's IP address for a moment, because that is how the internet works. Even if the IP is never stored, processing it is processing personal data, and a daily visitor identifier derived from it is pseudonymised data while it can still be linked. So:

1. Pick a legal basis. For minimal, privacy-friendly analytics this is normally legitimate interest (Art. 6(1)(f) GDPR). Consent is not required.
2. Inform visitors in your privacy policy (Art. 13): which tool, what is collected, why, for how long, and that the provider acts as your processor.
3. Sign a data processing agreement with the analytics provider (Art. 28).
4. Offer an opt-out visitors can use.

A privacy-policy clause you can adapt#

Web analytics. We measure how this website is used with [tool], a cookie-free analytics service that acts as our processor and hosts data in the EU. We process the page visited, the referring page, screen width and browser language and, in memory only, your IP address and user agent, used to derive approximate location, device type and a pseudonymous id that changes every day. Your IP address is not stored and nothing is placed on your device. The legal basis is our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR). Visit-level data is kept for [period]; after that only aggregated statistics remain. You can object at any time [how].

How byanalytics fits#

byanalytics sets no cookies and writes nothing to the device, never stores IP addresses, and rotates the visitor id every day so nobody is followed across days. A DPA applies to every customer automatically, and our privacy documentation includes a ready-made clause. How the counting works without cookies is explained in How cookieless analytics counts unique visitors; if you are comparing tools, see Google Analytics alternatives without cookies.

FAQ#

Is Google Analytics 4 legal without a cookie banner in the EU?#

Generally no. GA4 uses cookies to identify visitors, so the cookie law requires prior consent before it loads.

Does cookie-free analytics mean the GDPR does not apply?#

No. The IP address is processed for a moment and the daily visitor id is pseudonymised data, so you need a legal basis (normally legitimate interest) and a mention in your privacy policy. What you usually avoid is the consent banner.

Do I need consent for server logs?#

Server logs kept for security are normally covered by legitimate interest and need a mention in the privacy policy, not a banner, because nothing is stored on the device.

Can I use cookie-free analytics for sensitive sites?#

Yes, but review it with your lawyer if the pages themselves reveal sensitive data (health, religion, politics), and do not send personal data in custom events.