Does Your Analytics Need a Cookie Consent Banner?
When does web analytics legally require a consent banner — and when it doesn't. What ePrivacy and GDPR actually say.
Whether your analytics requires a cookie consent banner depends on one thing: does it store or access information on the visitor's device? If yes — a banner is required under EU law. If no — it is not.
That single question is what the ePrivacy Directive (Article 5(3)) asks. GDPR adds a second layer if the data qualifies as personal, but the trigger for the banner is ePrivacy, not GDPR.
Note: This article summarizes publicly available positions from data protection authorities. It is not legal advice. Review your specific implementation with a qualified lawyer before removing a consent banner.
What the law actually says
Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended) requires prior informed consent before "storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user."
The key phrase is "terminal equipment" — the visitor's browser, phone, or computer. Cookies are the obvious example, but the rule also covers localStorage, IndexedDB, and — under most interpretations — device fingerprinting, because fingerprinting reads characteristics of the device.
The exception: consent is not required when storage or access is "strictly necessary" to deliver a service the user explicitly requested. Analytics is not strictly necessary to deliver a website — it is necessary for the site owner's purposes. So analytics does not fall under the exception.
When a banner is required
You need a consent banner if your analytics tool:
- sets a cookie in the visitor's browser (including first-party cookies that persist across sessions)
- reads localStorage or sessionStorage to identify returning visitors
- uses device fingerprinting (canvas fingerprint, font list, WebGL hash, etc.)
- stores a persistent visitor ID in any browser API
Google Analytics 4, Matomo with cookies enabled, Hotjar, Mixpanel — all of these fall here. They set cookies or use fingerprinting. A banner is required.
When a banner is not required
You do not need a consent banner if your analytics:
- does not set any cookie
- does not read from localStorage or any other browser storage
- does not fingerprint the device
- does not send any persistent identifier linked to the visitor's device
The French data protection authority CNIL published a practical guide (Sheet 16, updated 2022) listing specific conditions under which analytics can be considered "audience measurement" that does not require consent. The conditions include: data used only for statistical purposes, no cross-site tracking, no sharing with third parties, and data retention limited to 13 months.
The EDPB (European Data Protection Board) confirmed in its Guidelines 2/2023 on Technical Scope of Art. 5(3) that stateless analytics that avoids reading from or writing to device storage does not fall under Art. 5(3).
What this means in practice
If your analytics script:
- does not set cookies
- does not read browser storage
- does not fingerprint
…then Article 5(3) does not apply, no consent banner is needed for the analytics itself, and you can track 100 % of visitors.
You still need a privacy policy explaining what you collect and why. But the banner — with its 20–60 % decline rates — is not required.
What Gauss collects
Gauss sends a JSON event per page interaction to collect.gausslab.io. The event includes the current URL, referrer, page title, screen width, and event name. It does not include an IP address, a cookie, a fingerprint, or any browser-stored identifier. The session key used to group events is computed server-side from non-identifying signals and expires at midnight.
Gauss does not set cookies. It does not read from localStorage. It does not fingerprint.
Whether this means you can remove your consent banner entirely depends on what other scripts are on your page. If you run Google Ads, Facebook Pixel, or any other cookie-setting tool — those still require consent. Gauss itself does not.
Summary
The consent banner requirement comes from ePrivacy Article 5(3). The trigger is access to or storage on the visitor's device. Cookie-free analytics that avoids cookies, browser storage, and fingerprinting does not trigger that requirement — and, under CNIL's guidance and EDPB's interpretation, does not need a banner.
Questions about your specific setup? Check the docs → or try Gauss →