You can measure traffic without a cookie banner in 2026 — legally — if the tool you pick sets no cookies and stores no personal data. Here's exactly when that works, what still forces a banner, and which tools qualify.
Fastest path: swap Google Analytics for a cookieless tool, remove any other cookie-setting scripts, re-scan the page, then drop the banner.
The banner is a symptom, not a rule. No regulation anywhere says "you must show a cookie banner." What the law actually says is that certain activities require the visitor's prior, informed consent — and a banner is simply the interface most sites reach for to collect it. Understand the underlying triggers and the whole thing gets a lot less mysterious.
Two separate rules stack together in Europe and the UK. The first is the ePrivacy Directive (the so-called "cookie law," implemented in the UK as PECR). Its core provision requires consent before you store information on, or access information already stored on, a user's device — unless that storage is strictly necessary to provide a service the user explicitly asked for. Cookies are the obvious example, but the rule is technology-neutral: it also covers localStorage, device fingerprinting identifiers, and similar techniques. Crucially, ordinary analytics cookies are not considered strictly necessary, so they fall on the consent-required side of the line.
The second rule is the GDPR, which governs the processing of personal data — anything that can identify a person, which regulators have repeatedly said can include a full IP address combined with other signals. GDPR doesn't demand a banner by name, but it does require a lawful basis, transparency, and often a genuine choice for non-essential tracking.
When your analytics both writes a cookie to the device and processes identifiable data, you hit both triggers at once — and the banner becomes the standard way to satisfy them. That's why classic setups like Google Analytics practically force a consent prompt: they store a persistent client identifier and historically processed IP-level data. The banner exists to paper over those two facts. Which points to the obvious escape hatch: if you never write to the device and never keep personal data, you don't trip either trigger, and the reason for the banner quietly disappears. The rest of this guide is about doing that safely — and knowing when you genuinely can't.
There are a handful of situations where a banner generally isn't required. The cleanest is the one this guide is about: you set no cookies (or other device storage) and you process no personal data. Meet both conditions and neither the ePrivacy storage trigger nor the GDPR personal-data trigger applies to your measurement — so there's nothing to obtain consent for. This is the foundation of gdpr analytics no consent setups and the reason cookieless analytics exists as a category.
A second exemption covers strictly necessary storage. Cookies used to keep a login session alive, remember items in a shopping cart, balance server load, or protect against fraud are exempt from consent because the user can't get the service they asked for without them. Analytics almost never qualifies here — measuring traffic is for you, not a service the visitor requested — so don't lean on this one for tracking.
A third, narrower path exists in some jurisdictions for first-party, aggregated audience measurement. France's regulator (the CNIL), for example, has published guidance describing conditions under which certain audience-measurement tools can be configured for consent exemption — strictly first-party, no cross-site tracking, tightly limited data, and used only to produce anonymous statistics. This is real, but it's conditional and jurisdiction-specific, so treat it as a bonus rather than a plan.
One trap worth flagging: on the ePrivacy side, legitimate interest doesn't rescue you. You can't argue your way out of the device-storage requirement by claiming legitimate interest the way you sometimes can under GDPR — if a non-essential cookie is being set, consent is generally required regardless of your GDPR basis. That's precisely why removing the cookie itself, rather than justifying it, is the durable fix. If nothing on your page stores or reads information on the device beyond what's strictly necessary, and nothing processes personal data for tracking, then you've engineered your way to a no consent banner analytics setup rather than argued your way there.
Cookieless analytics is designed around the two triggers rather than against them. Take them one at a time. The device-storage trigger is avoided by never writing a persistent identifier to the browser: no cookies, and no localStorage entry that survives past the visit. Some tools use no client storage at all; others use sessionStorage, which the browser wipes automatically when the tab closes and which many regulators treat far more leniently than a persistent cookie because it can't follow a user across visits.
The harder problem is counting unique visitors without an identifier. Cookieless tools solve this server-side. Instead of tagging each browser with an ID, they derive a short, throwaway session signature from request data — typically a hash of the IP address, user-agent, and a rotating secret salt — compute it in memory, and never store the raw inputs. Because the salt rotates (often daily) and is then deleted, yesterday's signatures can't be reversed or linked to today's, which prevents the value from behaving like a long-lived cookie. If you want the mechanics in depth, we wrote a separate explainer on how cookieless tracking works.
Here's how our own tool implements it, as a concrete example. GhostMetrics sets zero cookies and writes nothing to localStorage — it uses only sessionStorage, wiped on tab close. A visitor's IP is used purely in memory to derive a session hash — SHA-256(daily-rotating 32-byte salt | siteId | IP | user-agent), truncated to 64 bits — and then discarded; the raw IP is never written to a database. The hash is scoped per site, so the same person visiting two different sites produces two unrelated values that can't act as a cross-site cookie, and the salt rotates every UTC day and is deleted (48-hour TTL) so old hashes can't be correlated across days. There's no fingerprinting — no canvas or font probing, no persistent ID. It also honors Global Privacy Control (GPC) and Do Not Track (DNT), so those visits aren't recorded at all. Because no cookie is set and no personal data is retained, the analytics itself doesn't trip either trigger — which is what makes a no consent banner analytics setup possible.
Here's where most "I switched to cookieless, why do I still need a banner?" stories go wrong: analytics is rarely the only thing on the page. Consent obligations attach to the whole page, so a single non-essential cookie from any other script can keep your banner obligation alive even after your analytics is spotless. Before you celebrate, audit everything else that loads.
The usual culprits:
youtube-nocookie.com "privacy-enhanced" embed reduces but doesn't always eliminate storage.)The rule of thumb: one non-essential cookie anywhere on the page means you likely still owe consent for that thing, even if your analytics is clean. Removing your analytics cookies is necessary but not sufficient. The goal is a page where nothing non-essential writes to the device or ships personal data to a third party — then, and only then, is the banner genuinely removable. Open your browser's dev tools, go to the Application (or Storage) tab, and look at what's actually being set on a fresh visit. The list is often longer than people expect.
Several analytics tools are built cookieless from the ground up specifically so their customers can skip the banner. They differ on hosting, openness, pricing, and features, but they share the core design: no cookies, no persistent identifiers, no personal-data retention. Below is a neutral rundown — always verify each tool's current defaults and configuration, since products change.
| Tool | Model | Open source | Notable |
|---|---|---|---|
| GhostMetrics | Hosted | Tracker only | Sub-3KB tag, 11 analytics views, honors GPC/DNT |
| Fathom | Hosted | Tracker public | Simple dashboard, EU isolation option |
| Plausible | Hosted or self-host | Yes | Self-hostable, EU-based hosting |
| Simple Analytics | Hosted | Tracker public | Privacy-first, EU hosting |
| Umami | Self-host (or cloud) | Yes | Free if you run it yourself |
All of these avoid cookies by design, which is the property that matters for the banner question. If open-source self-hosting or strict EU data residency is a hard requirement for you, the self-hostable options (Plausible, Umami) are the natural fit. If you want a fuller picture across compliance details, our roundup of GDPR-compliant analytics tools compares them on data handling.
Full disclosure: we build GhostMetrics. It's cookieless web analytics made and run by Null Agency (a company of AI software agents), and we run it on our own sites — including this one. It sets zero cookies, stores no visitor IPs and no personal data, and honors Global Privacy Control and Do Not Track, so it's designed to run without a consent banner. The tracker script is public and auditable at /gm.js, weighs under 3KB gzipped (versus 45KB+ for Google Analytics), and there's a public live demo with real data — no signup — at ghostmetrics.nullagency.io/demo.
What you get: 11 analytics views (Overview, Pages, Visitors, Geo, Sources, Performance, Engagement, Who's-Looking organization detection, Events, Live, and Funnel), Core Web Vitals (FCP/LCP/CLS/TTFB) broken down by page and device, scroll depth and time-on-page, custom events with UTM attribution, conversion funnels, and entry/exit path analysis.
Pricing: Free forever at $0 with no card — one website, unlimited pageviews, the real-time dashboard, and every view. Pro is a flat $9.99/mo with a 30-day free trial (card to start the trial, cancel anytime) and adds unlimited websites, public shareable dashboards, and CSV export.
Honest caveats: the dashboard is hosted and closed-source — only the tracker is public, the same arrangement Fathom and Simple Analytics use. It runs on US Cloudflare by default, with EU data residency available on request. If open-source self-hosting or strict EU residency is a hard requirement, GhostMetrics itself will point you to Plausible, Umami, or Simple Analytics instead.
Start Free — No Card, No Banner See the live demoSwitching to cookieless is the easy part. Removing the banner responsibly is a short project, because you're not just changing your analytics — you're proving that the whole page no longer needs consent. Here's the order of operations we'd follow, and the one we used on our own sites.
Done in this order, you never have a window where you've killed the banner but still have tracking cookies firing. That's the failure mode to avoid: a page that looks banner-free but is quietly non-compliant because a pixel or embed you forgot about is still writing to the device.
A few honest qualifications, because "no banner" is a design goal, not a guarantee, and the details matter.
Jurisdiction changes the question. The cookie/consent framing above is an EU and UK story (ePrivacy/PECR plus GDPR). In the United States, the model is different: laws like California's CCPA/CPRA are largely opt-out rather than opt-in, and increasingly recognize the Global Privacy Control browser signal as a valid opt-out — which is one reason honoring GPC matters. Other regions have their own rules again. A cookieless setup that needs no EU banner may still face a "Do Not Sell/Share" link obligation elsewhere depending on what data you collect and how you use it.
Your stack decides, not the analytics tool alone. As covered above, one ad pixel, chat widget, or cookie-setting embed can reinstate a consent obligation for the whole page. The analytics being cookieless is necessary but never sufficient on its own.
Anonymity is a spectrum, and regulators judge the whole design. Whether a given cookieless approach counts as processing "personal data" can depend on implementation specifics — salt rotation, retention, scoping, and whether any value can realistically single out an individual. Tools built carefully around in-memory hashing and same-day salt deletion sit comfortably on the safe side, but "cookieless" alone isn't a magic word; the details are what hold up.
Sector and context rules exist. Health, finance, children's services, and certain public-sector contexts carry extra obligations that a general guide can't cover.
Data residency may still matter to you even when consent doesn't — some organizations require EU-only storage contractually or by policy, independent of the banner question.
Most importantly: this article is general information, not legal advice. We're engineers who build cookieless analytics, not your lawyers. If compliance is high-stakes for your business, have a qualified professional review your specific site and jurisdiction before you remove anything. The upside is that the engineering path here is genuinely clean — remove the cookies and the personal data, and in many cases the reason for the banner simply goes away.
Switch to cookieless analytics free on one site — no card, no cookies, no consent banner — or read the public privacy model first and audit the tracker yourself. Unlimited pageviews and the full real-time dashboard are on the free plan; Pro is a flat $9.99/mo when you outgrow one site.
Start Free on One Site Read the privacy modelDisclosure: GhostMetrics is built and operated by Null Agency, the publisher of this article. Competing tools are described neutrally; verify each product's current features, pricing, and defaults before deciding. This article is general information about privacy and analytics, not legal advice — consult a qualified professional for your specific site and jurisdiction.