GDPR-compliant analytics without consent banners
How to run website analytics that is GDPR compliant without a cookie consent banner, what the law actually requires, and a checklist for choosing a compliant tool.
All posts
You can run GDPR-compliant analytics without a consent banner. The trick is not clever legal drafting; it is collecting no personal data in the first place. If there is no cookie and no identifier, there is nothing to consent to, and the banner disappears.
What the GDPR actually requires
The GDPR governs personal data. An IP address and a device or client identifier both count. The separate ePrivacy rules require consent to store or read information on a visitor’s device, such as a cookie, unless it is strictly necessary, and analytics is not strictly necessary. So a tool that sets a cookie or keeps an identifier needs consent first. That is the banner.
The no-banner path
To lose the banner legitimately, choose analytics that:
- Sets no cookies and stores no local identifier
- Does not fingerprint the device or browser
- Keeps only anonymous, aggregated numbers, never a per-person profile
- Honours Do Not Track signals
- Lets you delete your data on request
A cookieless tool that meets these has no personal data to consent to. sonex is built to this standard: it counts a visit without ever identifying the visitor, so it is GDPR, PECR and CCPA-ready by default, with no consent banner required.
A checklist for choosing a compliant tool
| Question | Why it matters |
|---|---|
| Does it set cookies? | Cookies trigger the ePrivacy consent rule |
| Does it store identifiers? | Identifiers make data personal under the GDPR |
| Does it fingerprint? | Fingerprinting is tracking without a cookie |
| Where is data stored? | Data location affects transfer obligations |
| Is a DPA available? | You need one if any personal data is processed |
| Can data be deleted? | Deletion supports data-subject rights |
What you keep
Choosing the no-banner path does not cost you the numbers. You still see visitors, views, bounce and duration, referrers and top pages, coarse country, region and city geography, and realtime, funnels and sessions. The reports that answer real questions do not depend on tracking individuals.
Start without the banner
Remove the cookie-based tag and its consent modal, and add one script to your <head>:
<script defer
src="https://api.trysonex.com/sonex.js"
data-website-id="YOUR_WEBSITE_ID"></script>This is practical guidance, not legal advice. Your obligations depend on your jurisdiction and setup, so confirm the specifics with a qualified advisor, then enjoy a site with no banner to click.
Frequently asked questions
- Can analytics be GDPR compliant without a consent banner?
- Yes. If your analytics collects no personal data, no cookies, no identifiers, no fingerprints, there is nothing to consent to, so no banner is required. Cookieless tools like sonex are built this way and are GDPR, PECR and CCPA-ready by default.
- What makes analytics GDPR compliant?
- The shortest route is to avoid processing personal data at all. Tools that store no identifiers and only keep anonymous aggregates fall outside the consent requirement. Also confirm data location and the availability of a data processing agreement for your records.
- Do I need a data processing agreement for cookieless analytics?
- If any personal data could be processed, a data processing agreement is prudent. Genuinely anonymous analytics processes none, but a clear privacy policy and a DPA where offered are still good practice. Confirm your obligations with a qualified advisor.
sonex is privacy-first web analytics. No cookies, no consent banner, no personal data. Drop one script and read realtime visitors, funnels and a world map in seconds.
Try sonex free