Do you need a cookie banner for analytics?

The rule is about the device, not about cookies

The EU rule is Article 5(3) of the ePrivacy Directive. It allows "the storing of information, or the gaining of access to information already stored" on a user's device only with consent, based on clear information. There are two exceptions: what's needed to carry out the transmission, and what's strictly necessary for a service the user explicitly asked for. Analytics isn't named.

The European Data Protection Board explained how far this reaches in Guidelines 2/2023, adopted in October 2024. Two points matter here:

• It covers "information", not only personal data. A random ID counts.
• It names local storage alongside cookies. Keeping something in local storage doesn't escape the rule once that information, or anything derived from it, is read and sent off the device.

So an analytics tool that keeps a visitor ID in local storage has no automatic pass for being "cookieless". That includes the default setup of our own product, and we come back to that below.

The EDPB also makes the opposite point: the rule applying doesn't always mean you need consent, since an exemption may apply.

France: when audience measurement doesn't need consent

CNIL's page on audience measurement tools, dated July 2025, gives the clearest conditions we know of. To be exempt under French law, trackers must:

• be used strictly for measuring that site's or app's audience, on behalf of the publisher alone
• produce anonymous statistics only
• not lead to data being combined with other processing, or non-anonymous data being passed to third parties
• not allow a person's browsing to be followed across sites or apps

Those are the conditions. Separately, as recommendations, CNIL suggests telling users, for instance in the privacy policy, limiting the tracker's life to a period that allows useful comparisons over time, "such as" 13 months, without extending it automatically on new visits, and keeping the data for at most 25 months. It also suggests reviewing those periods from time to time.

Then comes the practical warning. Offers whose providers reuse the data for themselves fall outside the exemption, although some can be configured not to, and you should watch for transfers outside the EU. CNIL also says providers can't present a tool as certified or validated by CNIL. They can run its self-assessment and show you the documentation, so ask for it. As the publisher, you stay responsible.

This is CNIL's reading of French law. Don't assume that every other regulator takes the same view. Check with yours.

The UK has a written exception

The Data (Use and Access) Act 2025 added an exception for statistical purposes to the UK's rules. Storage or access doesn't need consent if its sole purpose is to collect statistics about how your service or website is used with a view to improving it, if the information is shared only to help make those improvements, and if users get clear information and a simple, free way to object. A government factsheet summarises it.

What's coming in the EU, and why you shouldn't plan on it yet

The European Commission's Digital Omnibus proposal of November 2025 would add an exception for aggregated audience measurement "carried out by the controller of that online service solely for its own use". It's only a proposal. The European Parliament's file, when we read it on 2 November 2026, said "Awaiting committee decision". Its wording may change, and today's rules still apply.

Find your own situation

Your analytics tool is often not the reason for your banner. Removing Google Analytics won't change anything if your ad tags stay.

Check your own site in ten minutes

1. Open your site in a private window, and don't click anything on the banner.
2. Open the browser's developer tools, then the Application tab in Chrome or Storage in Firefox and Safari.
3. Read Cookies and Local Storage. Note anything already there before consent, and which domain set it.
4. In the Network tab, reload and look for requests to other companies' domains.
5. Accept the banner, reload, and see what changes. Refuse it, reload, and check that nothing extra was set.
6. Compare what you found with what your privacy policy says.

A banner that doesn't change what happens is worse than none, because it promises something the site doesn't do.

Whatever you decide, tell visitors what you measure in your privacy policy, and give them a way to opt out. CNIL recommends the first, and UK law requires both for its exception.

Where MetricMind stands

Our product, against those conditions.

• By default, it stores IDs. MetricMind sets no cookies, and keeps a random visitor ID and session ID in the site's local storage. Article 5(3) applies to that as the EDPB reads it.
• The visitor ID lasts 13 months. It counts from the day it's made and visits don't extend it, as CNIL recommends. An ID made before we added this counts from 2 November 2026, so it can run a little past 13 months. In mobile apps the rule starts when the app ships an updated SDK.
• You choose how long events are kept. Each website picks 13, 25 or 37 months in its settings, and new websites start at 25, CNIL's figure. 37 goes past it. Websites added before the setting keep events while the account is active until an admin picks a limit, which also goes past it. The erasing runs as a check for now: our oldest data is from October 2026, so nothing has reached a limit yet.
• The data serves you alone, with one exception below. Each site's data stays separate, nothing follows a visitor across sites, we don't sell data or share it with advertisers, and it's hosted in Germany.
• The analyst sends results to an AI model provider. When you ask a question, or when it looks into a change on a schedule, query results go to the provider to write the answer, as our privacy policy explains. They're mostly aggregated, but some queries return individual events with their random IDs and the properties you send. CNIL's condition is about non-anonymous data reaching third parties, so this is the first thing to raise with your lawyer.
• Some features go beyond anonymous statistics. mm.identify() links visits to your own user IDs, connected payments carry customer IDs, and you can read a single visit step by step. CNIL's exemption is for anonymous statistics only, so using these can put you outside it.
• We haven't published a CNIL self-assessment. So we don't claim that MetricMind qualifies for its exemption, and we can't tell you that you can drop your banner.

Three stricter options:

• Storage-free mode (data-storage="none") stores nothing on the device, apart from remembering an explicit opt-out. Visitors are counted on our server with a hash of a daily random salt, the site, the IP address and the browser. The salt is deleted after two days and the IP isn't stored. The cost: someone who returns on another day counts as new. The EDPB's point about IP addresses is one to raise with your lawyer.
• Load the script only after consent, using your banner, as you would with any tool. You then count only those who accept.
• Respect browser signals with data-respect-gpc="true", and offer an opt-out with mm.optOut().