Short answer
Yes — you can run useful, GDPR‑compliant web analytics without showing a cookie consent banner, but only if the analytics do not process personal data (or are based on a lawful non‑consent legal basis such as legitimate interest and you meet the strict requirements for that). Practically the safest approach is to use “cookieless” analytics that do not store identifiers, do not fingerprint, anonymise IPs, and only collect aggregated, non‑persistent metrics. You must document your lawful basis, DPIA if needed, update your privacy notice, and offer an opt‑out.
What you must avoid (or do carefully)
- No persistent identifiers (cookies, localStorage keys) tied to a person or device unless you have explicit consent. Persistent IDs usually make the data personal.
- No fingerprinting (combining browser/device signals to create an identifier). This is likely personal data under GDPR.
- No raw IP storage unless immediately anonymised. IP addresses are personal data in many jurisdictions.
- No collection of identifiers (email, userID, hashed identifiers) without consent or another lawful basis.
- Don’t claim “anonymous” if re‑identification is easily possible.
Safe approaches that avoid a cookie banner
- Use a cookieless first‑party analytics solution that:
- Does not set tracking cookies or localStorage.
- Does not build cross‑site identifiers.
- Anonymises IPs before any storage/processing.
- Retains only aggregated, sessionless metrics (e.g., pageviews, referrers, page URLs, browser type and broad geo at country/region level only).
- Keeps short retention or no retention of raw records and cannot reconstitute individual journeys.
Examples: Plausible (in default mode), Simple Analytics, Fathom (with privacy settings), Matomo configured to disable cookies/identifiers and to anonymise IPs, or a lightweight custom approach that only counts pageviews server‑side.
- Server‑side aggregated logging
- Tally pageview counts on the server by incrementing per‑URL counters (no UID).
- Capture only broad, anonymised geo/IP (IP hashed and truncated) or discard IP after doing geolocation on the fly without storing it.
- No cookies or identifiers in responses.
When consent is required
- If you set any tracking cookie or persist an ID that can identify a device or person → require prior consent.
- If the analytics solution reconstructs user journeys across pages or sites or links behavior to a profile → consent is likely required.
- If you use third‑party analytics where the provider can combine data across customers → consent unless provider’s processing is contractually and technically limited and data are non‑personal.
Practical configuration checklist (cookieless, GDPR‑oriented)
- Do not set cookies/localStorage/sessionStorage for analytics.
- Do not create or persist unique identifiers.
- Implement IP anonymisation (e.g., mask/truncate last octet for IPv4).
- Disable user agent collection beyond broad values (e.g., browser family, major version).
- Limit geo granularity to city/region/country, preferably country only.
- Store only aggregate metrics or short‑lived logs; set a short retention (e.g., 24–72 hours) for any raw logs, then purge.
- Disable referrer full URL storage if it contains personal data (e.g., query strings); strip query params.
- Document data flows, data controller/processor relationships, and security measures.
- Update your privacy notice with the lawful basis and a simple explanation of what you collect and an opt‑out.
- Provide an easy opt‑out and respect Do Not Track if you choose.
- Conduct a DPIA if profiling or large‑scale monitoring is performed.
Suggested lawful bases
- Non‑consensual option: legitimate interest can be used for strictly limited, low‑intrusiveness analytics if you have carried out a Legitimate Interests Assessment (LIA) and documented balancing tests. This is often fragile; many organizations choose consent to be safer.
- Consensual option: ask for consent if you want visitor‑level tracking, cookies, or cross‑site analytics.
Example privacy notice snippet (short)
We collect anonymous, aggregated website analytics to improve site performance and content. We do not use cookies or other persistent identifiers for analytics, do not create user profiles, and anonymise IP addresses. No personal data are stored. You can opt out of analytics here: [link]. We process analytics under our legitimate interest to improve the website; see [full privacy policy link] for details.
Code examples / tools
- Plausible: Plausible’s default script is cookie‑free and privacy‑focused. Install their script or self‑host and enable cookie‑free mode.
- Minimal embed: <script async defer data-domain="example.com" src="https://plausible.io/js/plausible.js"></script>
- Matomo: disable cookies and user IDs in settings, enable IP anonymisation, and disable heatmaps/session recordings.
- Simple server‑side counter (pseudo):
- Client hits /count endpoint via image or fetch without cookies.
- Server increments a Redis counter keyed by page slug + date.
- Do not log IP, or log IP only temporarily to derive country then discard.
Risks and limitations
- Reduced capabilities: no cross‑session user journeys, fewer behavioural metrics.
- Legitimate interest relies on strong documentation and low intrusion — enforcement varies by EU state.
- Third‑party providers: check their contracts and data locations. If they receive raw logs with IPs/IDs, that may be personal data.
Recommended next steps
- Decide if you need visitor‑level analytics or aggregated insights only. If only aggregated, prefer cookie‑free analytics.
- Choose a provider or build a simple server‑side counter that explicitly does not store identifiers.
- Configure IP anonymisation, no cookies, strip query strings, short retention.
- Update privacy policy and carry out an LIA/DPIA as appropriate; document everything.
- Provide an easy opt‑out link and respond to access/deletion requests if any personal data are processed.
If you want, I can:
- Review your current analytics setup and point out what to change to avoid consent.
- Provide a ready‑to‑drop script or server pseudocode for a cookieless pageview counter.
- Draft a short LIA template or privacy notice paragraph tailored to your site. Which would you like?