Do you need a cookie banner for website analytics in 2026?
Updated September 2026 · 5 min read
You need a cookie banner for website analytics only if the analytics tool sets cookies or stores personal data. Google Analytics 4 does both, so it needs consent from EU and UK visitors. Cookie-free tools such as Clerion, Plausible, Fathom, Umami and Simple Analytics set nothing on the visitor's device and store no personal data, so under GDPR and PECR there is nothing to consent to and no banner to show for analytics. You may still need a banner for other things on your site, such as advertising or embedded video.
This is a plain-English reading of the rules and how the tools meet them, not legal advice. We build Clerion, one of the tools named.
What the law actually requires
Two rules apply, and they are usually confused with each other.
PECR and the ePrivacy Directive cover anything stored on or read from the visitor's device: cookies, localStorage, fingerprinting. Storing or reading requires consent unless it is strictly necessary for a service the visitor asked for. Analytics is not strictly necessary, so an analytics cookie needs consent. No cookie, no consent needed under this rule.
GDPR covers personal data. An IP address is personal data. A persistent identifier that follows one person across visits is personal data. If your analytics tool stores either, you need a lawful basis, and for analytics that usually means consent. If the tool discards the IP address and sets no identifier, there is no personal data to process and GDPR is not engaged by the analytics.
So the test for any tool is two questions: does it store anything on the device, and does it store anything that identifies a person? Two noes means no banner is required for analytics.
Which tools need a banner
| Tool | Sets cookies by default | Stores personal data | Banner needed for analytics |
|---|---|---|---|
| Google Analytics 4 | Yes | Yes | Yes, in the EU and UK |
| Mixpanel | Yes | Yes | Yes, in the EU |
| Matomo | Yes, configurable off | Configurable | Yes by default; no once configured cookie-free |
| Clerion | No | No; IP hashed in memory and never stored raw | No |
| Plausible | No | No | No |
| Fathom | No | No | No |
| Umami | No | No | No |
| Simple Analytics | No | No | No |
| Cloudflare Web Analytics | No | No | No |
Google Analytics has an extra complication. Even with a banner, several EU data protection authorities have ruled against GA over transfers of visitor data to the United States, and the position has moved several times. If a clean compliance story matters to you, a tool that stores data in the EU and never stores personal data is the simpler route.
How cookie-free analytics still counts visitors
The question everyone asks next is how a tool can count unique visitors without a cookie. The usual approach is a daily hash: the tool combines the IP address, the user agent and a salt that changes every day, hashes them, and keeps only the hash in memory for the day. The same person on the same day produces the same hash, so they count once. Tomorrow the salt changes and the link is gone. No cookie, no stored IP, nothing that can be tied back to a person after the day ends.
Clerion goes a step further and keeps sessions session-only, with no cross-session linking at all. Location is derived through an EU-based lookup service under a data processing agreement, and no personal data is sent to the AI that writes the briefings. Details at /data-journey.
What you give up without cookies
Cookie-free measurement is accurate for traffic questions and honest about what it cannot do.
- Returning visitors over long windows. Without a persistent identifier, a person coming back after several weeks looks like a new visitor. Daily and weekly uniques are fine; 90-day attribution is not possible.
- Cross-device identity. The same person on a phone and a laptop is two visitors.
- User-level retention. If your question is whether a specific cohort came back in month three, that is a product analytics question and needs consent and an identifier.
What you gain is usually larger for a small site: the 10 to 40% of visits that ad blockers and consent banners hide from Google Analytics show up, because cookie-free tools are rarely on blocklists and there is no banner to reject.
When you still need a banner
Removing analytics cookies does not remove every reason for a banner.
- Ad networks, retargeting pixels and Meta or Google Ads tags set cookies and need consent.
- Embedded YouTube, Vimeo, maps or social widgets set cookies from the third party.
- Login sessions and shopping carts set cookies, but these are strictly necessary and need no consent, only disclosure in your privacy policy.
If analytics was your only non-essential cookie, switching to a cookie-free tool lets you remove the banner entirely. Many small sites find that this alone lifts landing page conversion, because the first thing a visitor sees is the page rather than a dialog.
Frequently asked questions
Is Google Analytics GDPR compliant without a cookie banner?
No. GA4 sets cookies and processes IP addresses, so it needs consent from EU and UK visitors before it loads.
Is Plausible GDPR compliant without a banner?
Yes for the analytics itself. Plausible sets no cookies and stores no personal data, so there is nothing to consent to. The same is true of Fathom, Umami, Simple Analytics and Clerion.
Can Matomo run without a cookie banner?
Yes, if you disable cookies in its configuration and anonymise IP addresses. It sets cookies by default, so this is a deliberate setup step.
Does Clerion need a cookie banner?
No. It sets no cookies, does no fingerprinting and stores no personal data by default. An optional consent banner mode exists for teams that want explicit consent anyway; a consent cookie is written only after a visitor accepts. The compliance detail is at /gdpr-compliance and /pecr-compliance, and plans start at $14 a month at /pricing.