Do I need a cookie banner for analytics?
Short answer: it depends on the tool. If your analytics sets a cookie or stores anything on the visitor's device, you generally need consent first. If it is cookieless and stores nothing, you generally do not need a banner for it.
Where the rule comes from
In the EU and UK, the consent requirement for cookies comes from the ePrivacy Directive, Article 5(3). It is broader than the word "cookie": it covers storing information on, or reading information from, a user's device. Strictly necessary storage is exempt; analytics that profiles a user generally is not.
When you do need consent
- The tool sets a cookie or writes to local storage to recognise returning visitors.
- It uses device or browser fingerprinting as an identifier.
- It builds a cross-site or long-term profile of the individual.
In those cases you typically need prior, informed, opt-in consent before the script runs, which is what a compliant cookie banner is for.
When you generally do not
- The tool sets no cookie and reads or writes nothing on the device.
- It keeps no per-visitor identifier and stores no raw IP.
- It reports aggregate counts only, with no profile of the individual.
A tool like that does not, on its own, trigger the Article 5(3) consent requirement. That is the model PlainStats uses, so it can reduce or remove the banner you would have needed for analytics. Read how cookieless analytics works.
Two cautions
- Consent and a banner are about ePrivacy. GDPR can still apply to any personal data you do process, separately.
- One privacy-friendly tool does not clear your whole site. Anything else that uses cookies (ads, embeds, chat, A/B testing) may still need consent.
Sources
- ePrivacy Directive 2002/58/EC, Article 5(3): eur-lex.europa.eu.
- European Data Protection Board guidance: edpb.europa.eu.
This is general information, not legal advice, and rules differ by country and change over time. Check with a data protection officer or qualified counsel for your specific case.