You've heard that some analytics tools don't need cookie consent banners. But how do they actually identify sessions without a cookie? We explain the technique and the privacy trade-offs.
Traditional analytics tools — including Google Analytics — identify returning visitors by setting a persistent cookie on the user's device. That cookie contains a unique identifier that persists across sessions, sometimes for years. When the visitor returns to your site, the analytics script reads the cookie, recognises the user, and links the new session to their history.
This works well from an analytics perspective. The problem is that under GDPR (and similar laws like CCPA), a persistent tracking identifier stored on a user's device is personal data. You need explicit consent to set it — hence the cookie banners that now interrupt every European website.
Privacy-first analytics tools take a different approach. Instead of writing an identifier to the user's device, they use techniques that identify a session without persisting anything. The most common approach is an in-memory UUID.
Here's how it works:
a3f2b...c91d) and stores it only in JavaScript memory — not in localStorage, sessionStorage, or a cookie.Because the identifier is never written to the device, it cannot be read back later. There's no way to link two separate visits to the same individual. This is fundamentally different from cookie-based tracking.
Some privacy-first tools use browser fingerprinting to recognise returning visitors without cookies. This involves combining stable browser characteristics — screen resolution, timezone, fonts, GPU renderer, user-agent string — into a hash that's likely unique to a specific device and browser.
The privacy implications of fingerprinting are significant. Even though no data is written to the device, the process of constructing a fingerprint still involves profiling the user across visits. Several data protection authorities have concluded that fingerprinting constitutes personal data processing under GDPR, regardless of whether a cookie is set.
Web Analyzer App does not fingerprint. We use in-memory UUIDs only. If you close your browser, you're a new visitor. This means our data under-counts true return visitors — but it means we're genuinely not tracking individuals across sessions.
The GDPR's consent requirement for cookies is actually part of a broader rule in the ePrivacy Directive (also called the Cookie Law): you need consent to store or access information on a user's device. Cookies, localStorage, IndexedDB — all covered.
An in-memory variable that exists only for the lifetime of the current JavaScript execution context is not stored on the device. It can't be read back after page reload. There's nothing to consent to, because nothing persists.
The same logic applies to IP addresses: we derive an approximate country and city from the visitor's IP using a geolocation lookup, but we never store the IP itself. An approximate geographic region is not personal data — it can't identify an individual.
Cookie-free analytics is not a perfect substitute for cookie-based analytics. Here's what you gain and what you give up:
| Cookie-based analytics | Cookie-free analytics |
|---|---|
| Tracks return visitors across sessions | Each session is independent |
| Accurate "New vs Returning" metric | All visitors appear new |
| Requires consent banner (EU) | No consent required |
| Sets personal data on device | No data written to device |
| ~10–30% consent rate (typical) | 100% of visits tracked |
That last point deserves emphasis. A typical consent banner blocks 60–80% of European visitors from being tracked at all. By switching to cookie-free analytics, you'll often end up with more accurate aggregate data — because you're counting all your visitors, not just the fraction who clicked "accept".
We're not lawyers, and we can't give you legal advice. But here's the practical picture:
Most GDPR lawyers agree that analytics tools meeting these criteria do not require a consent banner under either GDPR or the ePrivacy Directive. The UK ICO and several EU DPAs have published guidance consistent with this view.
If you want to verify for your specific jurisdiction, share our privacy policy with your legal counsel. It's written in plain language and explains exactly what data we process and why.
If you're ready to switch to analytics that doesn't require a consent banner, get started free — no credit card, two-minute setup.