Do I need a cookie banner for analytics?

Short answer: with analytics that sets cookies, yes. With analytics that sets no cookies and keeps no personal data, often not, but it depends on the country and on what else your site does. This page is general information, not legal advice.

The rule

The ePrivacy Directive, transposed into each country's law, requires consent before storing or reading information on a visitor's device, unless it is strictly necessary for the service. Analytics cookies are not strictly necessary, so they need consent. That is why sites with Google Analytics show a banner.

France and Spain: an exemption for audience measurement

The French CNIL and the Spanish AEPD accept audience measurement without consent when it is limited and harmless. Their published criteria include:

• the statistics serve only the site owner and are not shared or reused by the provider;
• they produce anonymous, aggregated figures, with no tracking across different websites;
• visitors are informed, usually in the privacy policy;
• data is kept for a limited time; both authorities recommend no more than 25 months.

The AEPD's January 2024 guide lists the metrics that fit: audience per page, referring sites, device and browser, time on page, bounce rate, clicks and geographic area. Statsdot measures exactly those, with no cookies and no personal data.

Germany: case by case

German law (§ 25 TDDDG) and the guidance of the German data protection authorities are stricter. They treat reading information from the device through JavaScript as access to the device, and they decline to declare audience measurement generally exempt. Cookieless analytics without personal data has good arguments, but there is no blanket answer. If you operate in Germany, check your setup with your data protection adviser.

What else is on your site matters

Even with cookieless analytics, you need a banner if your site loads other things that set cookies or track visitors: advertising pixels, embedded videos, maps, chat widgets or social buttons. Removing analytics from the banner does not remove the banner if those remain.

What to put in your privacy policy

Say that you use Statsdot for aggregated statistics, what is measured, that no cookies are used and no IP addresses are stored, and that the data stays in the EU. You can link to our explanation of how it works.