Do you need a cookie banner for analytics?

What is a cookie banner asking about?

The banner is not about cookies as such. In the EU, the rule behind it (Article 5(3) of the ePrivacy Directive) is about storing information on a visitor's device, or reading information that is already there. That needs the visitor's consent unless it is strictly necessary for something they asked for, such as keeping them signed in.

Ordinary analytics does both: it puts an identifier in a cookie or in the browser's storage, and reads it back on every page, so it can tell a returning visitor from a new one. That is what the banner exists to ask about.

Measuring without storing anything

Analytics that stores nothing on the device and reads nothing from it is outside that rule. BackendFree's measurement works that way:

• No cookie, no local or session storage, and no fingerprinting. Nothing is written to the device, and nothing is read from it beyond what the page already knows about itself.
• The IP address is used for one request and never kept. A visitor is told apart from others by a key derived from it that cannot be reversed, changes every day, and differs on every website.
• The page and where the visitor came from are cut down. The path is kept without its query string, and the referrer is kept as a host only.
• Opting out is honoured. A browser sending Global Privacy Control or Do Not Track records nothing at all.
• Nothing outlives its use. Individual events are deleted after 60 days, and what stays for about 25 months is daily counts with nothing in them about a person.

Swiss law is satisfied by storing nothing plus those opt-out signals.

One honest caveat if you are in the EU. European regulators have taken a broader view of measurement that derives an identifier from an IP address, even without storing anything. This design matches the criteria under which audience measurement is treated as exempt from consent: first party only, no tracking across sites, no identifier kept, no combining with other sources, statistics only, and an opt-out that works. The final assessment for your own site is yours to make.

What else on your site might need one

A banner is about the whole page, not one tool on it. Anything else that stores or reads on the visitor's device is judged on its own: an embedded map or video, a chat widget, an advertising tag, a social button, or a font loaded from somebody else's server. If any of those is on your site, it may need consent even when your analytics does not.

What the GDPR still asks of you

The GDPR applies to the IP address for the moment it arrives, whatever the banner question. You need a lawful basis for measuring, usually your legitimate interest in knowing how your site is read, and a short paragraph in your privacy notice saying what you measure and how. The privacy notice sets out exactly what the measurement keeps, so you can describe it accurately in your own.

This guide explains how the rules apply to one way of measuring. It is not legal advice about your website.