The Cookieless Analytics Setup: When You Can Drop The Banner
Your cookieless analytics can count visitors without storing a thing. How it works, when UK and EU rules let you skip the banner, and what brings it back.
The OxyPages Team · · 9 min read
You want to know whether anyone reads your site. You don't want a pop-up asking every visitor to accept cookies before they've seen a single word.
Paste Google Analytics into the page and, in the UK and EU, the banner comes with it. The way out is to count without storing anything on the visitor's device. That's what the label "cookieless analytics" promises, and for a small site it often does remove the banner. Not always, though, and the exceptions are where people get caught.
So here's how it works, when UK and EU rules let you skip consent, and what brings the banner back. It's the mechanism under the Google Analytics alternatives, gone deeper.
I'm not a lawyer, and this isn't legal advice. It's the mechanism, explained well enough to know which questions to ask.
TL;DR: Cookie-free counting either runs a small script, which usually tells visitors apart with a code that changes every day, or counts on the server as each page is served, with no script at all. In the UK and EU, the consent rule is about storing or reading information on a device, not about cookies by name. Going cookieless removes the banner only when nothing else on the page stores anything and the counting fits your regulator's rules, which in the UK means telling visitors and offering a way to opt out. YouTube embeds, podcast players, ad pixels and chat widgets bring the banner straight back.
How Do Analytics Work Without A Cookie?
Analytics without cookies count page loads without giving each browser a long-lived ID, and tell visitors apart for a short window, usually a day, or not at all. There are three common ways, and they differ in where the counting happens.
| Method | Where it runs | What it keeps | Ad blockers hide visitors? | Examples |
|---|---|---|---|---|
| Cookie-based script | In the visitor's browser | A cookie with a unique ID | Yes, often | Google Analytics 4 |
| Cookieless script | In the browser, sends to a vendor | A rotating code, or no visitor ID at all | Sometimes | Plausible, Fathom, Simple Analytics, Umami, Cloudflare's beacon |
| Server-side counting | On the host, as the page is served | A daily code or nothing, no script on the page | No | Some static hosts, raw server logs |
The first row needs consent almost everywhere in Europe; Google's documentation lists the _ga cookie's default lifetime as two years. A script can be refused by a blocker. A count made on the server, as the page is sent, can't.
How Cookieless Counting Tells Visitors Apart
Many cookieless tools hash a few things the browser sends anyway and throw the key away at midnight. A few, like Simple Analytics, skip visitor IDs entirely and estimate unique visits from the referrer.
The hashing version works like this. Every request carries the visitor's IP address and a user agent string naming the browser and device. Mix those with the site's name and a secret that changes daily, run it through a one-way hash, and you get a code like 9f2c41e0. Same person, same day, same code. Tomorrow the secret changes and the same person produces a different code.
Plausible publishes this recipe, and as of November 2026 says the daily salt is rotated and deleted every 24 hours and raw IPs and user agents are never stored. Three things follow:
- A "visitor" means a visitor on one day. Someone who comes back on Monday and Thursday is two visitors that week. Your weekly uniques run higher than a cookie tool would show.
- Nobody can be followed across days. That's the privacy win, and also why you get no returning-visitor stats or long journeys.
- Cookieless isn't the same as anonymous. An IP address is usually personal data under GDPR, and the counting uses it for a moment before hashing. Good tools never store it, but the processing still happened.
When Can You Skip The Cookie Banner?
In the UK, analytics that only measures how your site is used can skip consent, as long as you tell visitors and give them a free way to opt out. EU law has no such general exception, so you're on firmest ground when nothing is stored on the device and nothing follows a visitor past a day. "No cookies" on its own isn't the test.
Here's what most "no banner needed" claims skip. The European rule, Article 5(3) of the ePrivacy Directive, covers storing or accessing information on a device by any technical means. The European Data Protection Board's Guidelines 2/2023, finalised in October 2024, spell out that tracking pixels, local storage and some IP-based tracking can fall under it, even though none of them is a cookie. EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive
So the honest version, region by region:
- UK. The Data (Use and Access) Act 2025 added an exception for technology used only to collect statistics about how your site is used, so you can improve it. You still have to tell people clearly and give them a simple, free way to object, and it doesn't cover tracking individuals, advertising or anything cross-site. The ICO finalised its guidance on these exceptions on 29 April 2026. ICO guidance on storage and access technologies
- France. The CNIL lets audience measurement skip consent if it's limited to that purpose, stays on one site, isn't combined with other data, and keeps trackers no longer than 13 months. Visitors must still be told and able to object. CNIL sheet on using analytics on your websites
- Elsewhere in the EU. Regulators read the rule differently. Server-side counting that stores nothing on the device is the lowest-risk setup, but because the EDPB treats some IP-based tracking as access too, even that isn't a guaranteed pass.
- The US and most other places. There's generally no consent-banner rule for first-party analytics, though some state laws give visitors rights over data that's sold or shared.
- Everywhere. In health, finance or anything for children, ask someone qualified first.
My working rule for a small brochure site: use a cookieless method whose visitor code changes every day and never keeps the raw IP, describe it in your privacy notice with a way to object, and don't put a banner up for that alone.
What Puts The Banner Back On Your Page
Anything else on the page that stores or reads data on the visitor's device puts the banner back, however clean your counting is.
The usual suspects on a small static site:
- A standard YouTube embed. It stores data before anyone presses play. The
youtube-nocookie.comaddress cuts that down, but don't assume it's clean. - Ad and social pixels. The Meta pixel, LinkedIn Insight, TikTok. None of the exemptions above cover advertising.
- Chat widgets. Most store a session ID so a conversation survives a reload.
- Maps, booking widgets and payment buttons. Somebody else's code, with their cookies.
- A leftover Google Analytics tag. The commonest one. Added years ago, forgotten since.
To check, open a private Chrome window and switch off "Block third-party cookies" on its start page, then load your page, press F12, go to the Application tab, and look under Cookies and Local storage. Anything listed that the page doesn't strictly need is something to remove, replace or ask consent for.
Not sure which scripts your page loads? how a script tag pulls JavaScript into a page shows where to look in the HTML.
A Podcast Show-Notes Site, Counted Without Cookies
Take a weekly interview podcast with a small static show-notes site: one page per episode, with links, guest bios and a transcript. The host wants to know which episodes people read about, where readers come from, and whether anyone uses the transcripts. None of that needs to know who anybody is.
Any of these tools shows which episode pages get read and whether transcripts are read on phones. A guest's social post usually shows as its own referrer. Taps from most podcast apps and many email newsletters arrive with no referrer at all, so they land under direct visits.
On OxyPages the counting happens on the server while each page is served, so the HTML carries no script and the browser gets no cookie. Most bots, crawlers and requests for images and CSS are filtered out, so a view is closer to a real person opening a page. Visitors are told apart within a day by a one-way code made from the site, the IP address and browser details, mixed with a secret key that changes every day. The IP itself isn't stored. The limits: statistics cover the last 90 days, there are no custom events, and there's no opt-out switch, so you can't exclude a visitor who objects.
The catch on a podcast site is the player. An embedded Spotify, Apple or YouTube player on each episode page stores its own data as it loads, bringing the banner back. Link to the episode in each app instead, or use a player that only loads when someone clicks it.
None of it counts listens. Downloads live with your podcast host.
How To Describe Your Cookieless Analytics In A Privacy Notice
Say what you count, how you tell visitors apart, how long you keep it, and how someone can object. Four sentences usually cover a small site.
For the podcast site above, it could read: "Our web host counts page views, referring sites, device types and rough location as pages are served, so we can see what's read. We use no cookies or tracking scripts. To tell visitors apart within a day we use a one-way code made from your IP address and browser details, and we never store the IP address itself. Statistics are kept for 90 days, and you can object by emailing hello@yourpodcast.com."
That last sentence matters. The UK and French exemptions both expect a way to object, and most host-level counting has no opt-out button, so an email address is the honest minimum.
What To Do Next
Run the DevTools check first and note every cookie and third-party script. Then pick one counting method, and if you're still choosing a tool, weigh up the Google Analytics alternatives. For "how many and which pages", a cookieless script or your host's server-side counting will do. In the UK either can run without a banner if nothing else drags it back; in the EU, server-side is the safer pick. Add the privacy notice paragraph, including how to object.
Who this isn't for: anyone whose business depends on ad attribution or multi-visit funnels. A daily code can't do that job, so keep a cookie-based tool with consent for it.
If you'd rather not install anything at all, put the site somewhere that counts visits for you and the statistics are there from the first visit, with no script to paste. For a personal site, a free account includes them, no card needed.
FAQ
Does Going Cookieless Mean I Never Need A Cookie Banner?
Not always. In the UK it usually does, if you explain the counting and give visitors a free way to opt out. In the EU it depends on your regulator, and counting that stores nothing on the device is the safest position. A YouTube embed, an ad pixel or a chat widget on the same page can still need consent on its own.
Is Counting Without Cookies GDPR Compliant?
It can be, but the label alone doesn't make it so. Most tools briefly process the IP address, which is usually personal data under GDPR, so you need a lawful basis and a line in your privacy notice. Tools that never store the raw IP, and whose visitor code changes every day, are the safer choice.
Do Visitors Need A Way To Opt Out?
In the UK and France, yes, for the consent exemptions to apply. Most cookieless tools and hosts have no opt-out button, so give an email address in your privacy notice. If someone does object and your tool can't exclude them, that's a reason to switch to one that can.
Do I Still Need A Privacy Policy Without Cookies?
Yes. Analytics still processes some personal data, and visitors have a right to know. One paragraph covering your cookieless analytics, what it counts and how to object, is usually enough for a small site.