Do Cookieless Analytics Require Consent in Europe?

The short answer

There is no universal rule that analytics becomes consent-free as soon as it stops setting browser cookies. You need to know what the tool does, which data it processes, which visitors it reaches, and which country’s implementation of the ePrivacy rules applies. A truly minimal, aggregate measurement setup is very different from behavioral analytics linked to accounts or purchases, even when both vendors market their product as “cookieless.”

Two questions are often mixed together

Device storage or access: Article 5(3) of the ePrivacy Directive concerns storing information on a user’s device or gaining access to information already stored there. The EDPB has explained that its technical scope is not limited to traditional cookies. URL and pixel tracking, unique identifiers and other methods can be relevant depending on the technical facts. A consent exception may apply, but it needs to be assessed rather than assumed.

Personal data processing: Separately, the GDPR may apply where data such as IP addresses, identifiers or linked event histories is personal data. An aggregate dashboard does not necessarily mean collection was anonymous. A data protection legal basis and applicable safeguards may still be needed even if no consent is required for device access.

How national guidance differs

France: The CNIL describes a narrowly conditioned exemption for certain audience measurement. Its published conditions include limiting purposes, not combining data with customer records or cross-site statistics, giving notice and an objection mechanism, limiting tracking to one publisher, and applying specified IP and lifetime limits. Meeting those conditions requires configuration-specific review.

Netherlands: The Dutch data protection authority distinguishes limited analytics cookies with no or little privacy impact from other cookies. It also explains that use of personal data still requires a GDPR legal basis.

United Kingdom: The UK is not an EU member, but is a useful illustration of different national rules. Following the Data (Use and Access) Act 2025, the ICO describes a statistical-purpose exception for certain storage or access technologies, subject to conditions including transparent information and an easy means to object. This does not create an EU-wide exception.

For a site serving multiple European countries, do not extrapolate one regulator’s example to all visitors.

How to evaluate a privacy-focused analytics tool

1. Define the measurement need. Is it only aggregate visits and referral sources, or user-level journeys and conversion attribution? Keeping the scope small matters.
2. Inspect the live configuration. Check whether cookies, local storage, session storage or other identifiers are created or read, rather than relying on a general vendor claim.
3. Review transmitted data. Examine analytics requests, URL parameters, referrer values, account identifiers and any fingerprinting-like signals. Be mindful that some processing is server-side and not observable in a browser trace.
4. Check the provider’s processing model. Review retention, IP handling, data combinations across customers, third-party recipients and optional features that may change the analysis.
5. Consider the visitor locations. Assess relevant local guidance and any applicable exemption with appropriate legal or privacy support.
6. Test the deployed version. Features enabled later, tag-manager changes and plugins can alter what a “cookieless” setup actually does.

What about Plausible and Simple Analytics?

These tools are commonly considered for aggregate traffic reporting and position themselves around privacy-friendly measurement. They may be suitable candidates when individualized marketing attribution is unnecessary. However, a product name or a “no cookies” claim cannot by itself establish that every installation qualifies for a particular exemption. Review the current product documentation, enabled features and actual data flows before drawing that conclusion.

A useful rule for making the decision

Start by minimizing the data you collect. For basic page-view trends, avoid features you do not need, such as persistent user journeys or links to customer accounts. Then verify the implementation and assess the rules relevant to your audience. The output should be a description of the actual configuration and its remaining questions, not a universal “GDPR compliant” badge.