Analytics and consent: what you can measure without a banner
Which website measurement is possible without consent, what makes analytics consent-free, and why that usually gives a business better data.
The short answer
The consent requirement attaches to storing or reading information on a visitor’s device. Analytics that set a cookie or another persistent identifier therefore need consent before they run. Analytics that count visits in aggregate without placing an identifier can, depending on the tool and its configuration, operate without that consent, and several privacy-focused products are built specifically for this. What such measurement gives you is the set of questions a business website actually asks: how many visitors, from which sources, on which pages, in which countries and on what devices, how many completed a goal, and what changed after you changed something. What it does not give you is following one person across days and devices, advertising audiences, or attribution spanning weeks. For a business website those are losses on paper only, and the gain is real: because every visitor is counted rather than only the ones who accept a banner, the numbers are more complete than consented analytics usually manages.
What you can measure either way
| Question | Without consent | Requires consent |
|---|---|---|
| Visitors and page views per day | Yes | |
| Traffic sources: search, social, referral, campaign tags | Yes | |
| Which pages are read, and where visitors leave | Yes | |
| Country, device type, browser | Yes | |
| Goal completions: form sent, purchase, download | Yes | |
| Effect of a change, before and after | Yes | |
| Real user performance metrics, configured without identifiers | Generally yes | |
| Returning visitors across days | Yes | |
| One person’s journey across devices | Yes | |
| Advertising audiences and retargeting | Yes | |
| Attribution to a click from last week | Yes | |
| Session recordings and heat maps | Yes, and reconsider whether you need them |
Setting it up properly
- Choose a tool designed for consent-free operation and read its documentation on identifiers and data storage.
- Confirm processing location and obtain the data processing agreement.
- Verify in the browser that no cookie or persistent identifier is set by the analytics script.
- Define your goals: the form submissions, purchases and key page views that matter.
- Tag campaigns consistently so sources are meaningful.
- Describe it accurately in your privacy statement.
- Remove the old cookie-based tool and its consent category, then re-scan the site.
- Add real-user performance monitoring on the same basis if you want speed data.
What this does to the banner
If analytics was the only non-essential category, removing identifiers may remove the need for the banner altogether, which is worth checking. Many business sites have exactly two consent categories, analytics and an embedded video or map, and both have consent-free alternatives. The result is a site with no banner, an honest short privacy statement, faster pages and better data, which is a combination worth a morning’s work.
What this means for you
You can measure visitors, sources, pages, countries, devices, goals and the effect of changes without consent, provided the tool stores no identifier on the device, processes lawfully and is described accurately in your privacy statement. Verify those properties yourself rather than trusting the marketing. You give up cross-day tracking and advertising audiences, and you gain complete counts and, often, the ability to drop the banner entirely. This is general information rather than legal advice.
Frequently asked questions
Is it true that some analytics need no cookie banner?
Analytics that do not store or read information on the visitor's device, and that do not process data in a way requiring consent, fall outside the consent requirement for storage. Several privacy-focused tools are built for this, counting visits in aggregate without persistent identifiers. Whether a specific configuration qualifies depends on the tool and how it is set up, so check the vendor's documentation and, for certainty, your adviser or the supervisory authority's guidance.
What do we lose without consent-based analytics?
Following an individual across days and devices, building advertising audiences, and multi-day attribution of conversions to campaigns. You keep visitor counts, sources, pages, countries, devices, goal completions and the before-and-after effect of changes. For running a business website that is nearly everything you need; for optimising large paid advertising programmes it is not, and those businesses add the ad platform's own consented measurement.
Is the data actually better?
Usually more complete. Consent-based analytics measures only visitors who accept the banner, and is blocked for many who do, so many sites report a fraction of reality. Counting everyone anonymously gives true totals and trends. Businesses that switch often discover they have substantially more traffic than they believed.
Sources
- Autoriteit Persoonsgegevens: Cookies (accessed 2026-09-12)
- European Data Protection Board: Guidelines 05/2020 on consent (accessed 2026-09-12)