Do analytics need a cookie banner? ePrivacy, GDPR, CNIL

This is general information, written by someone who builds analytics software. It isn’t legal advice, and it doesn’t say that Trailic or any other tool is compliant or exempt. The decision belongs to you as the site’s owner, and to your lawyer if you have one.

The short answer: it depends on what the tool reads from the device, what it does with it, and which country’s regulator you answer to. “We don’t use cookies” doesn’t settle it. In France there’s a documented way to do without consent, and its conditions are stricter than most people expect.

Two laws, two questions

ePrivacy, Article 5(3), asks whether you store information on someone’s device or gain access to information stored there. If you do, you need consent, unless the operation is only there to carry the communication, or is “strictly necessary” to provide a service the user explicitly asked for. The word is “information”, so it applies whether or not the data is personal.

The GDPR asks whether you process personal data. Recital 30 names internet protocol addresses among online identifiers, and recital 26 says pseudonymised data that can be attributed with additional information still concerns an identifiable person. If it applies, you need a legal basis, you must inform people, limit how long you keep data, and honour their rights.

These are separate tests. Passing one says nothing about the other. The CNIL says so about its own exemption: audience measurement stays subject to the GDPR even when it needs no consent.

Why no cookies isn’t the test

The EDPB’s Guidelines 2/2023, adopted in October 2024, are the document to read. Paragraph by paragraph:

Article 5(3) “does not exclusively apply to cookies” (paragraph 1).
JavaScript that instructs a browser to send information “clearly falls within the scope” (paragraph 33).
Collecting information through context data such as the user agent “can lead to the application” of the article (paragraph 43).
An IP address triggers it when it originates from the user’s device. Unless you can ensure it doesn’t, you have to “take all the steps” the article asks for (paragraph 55).
The article applying “does not systematically mean that consent needs to be collected” (paragraph 56). Exemptions are analysed case by case, with national law and national guidance (paragraph 4).

So a script that makes the browser send a request, with a server deriving an identifier from address and user agent, should assume the rule may apply, then ask whether an exemption does.

You’ll read other views, as of November 2026: Plausible’s data policy says “you do not need cookie banners for analytics”, and PostHog’s docs say its hash isn’t considered personal data. Those are vendors’ readings of their own products, and they may often be right. Guidelines aren’t a court ruling either. The responsibility for your site stays yours.

What the CNIL’s exemption requires

The CNIL treats some audience measurement as strictly necessary to run a site, so it doesn’t need prior consent. Under its 2020 guidelines and its page of July 2025, the trackers must:

Serve one purpose only: measuring the audience of that site or app, on behalf of the publisher alone.
Produce anonymous statistics only.
Not lead to the data being combined with other processing, or non-anonymous data being passed to third parties.
Not allow global tracking across sites or apps. A shared identifier used to de-duplicate or measure unified reach is excluded.

The CNIL also recommends telling users, for example in the privacy policy, limiting a tracker’s lifetime (thirteen months is its example, with no automatic renewal), keeping collected data for at most twenty-five months, and reviewing those periods.

Since July 2025, a self-assessment tool turns this into criteria. It’s written for vendors, and it’s the most concrete thing you can read:

Objective	What the grid asks
Audience only	Marketing measurement is off by default: conversion channels, campaigns, acquisition channels. So are cohorts used to show different content
Minimal data	HTTP header data reduced, for example to major versions. At most three kinds of event: being on a page, using a feature, timing statistics
No outside tracking	No customer ID or CRM import, no UTM or campaign IDs in URLs, referrer limited to the host, no integration with third-party tools
Address	In anonymous mode, on by default: shortened before the hash, IPv4 to /24 and IPv6 to /48, then dropped. With it off, it goes in whole, then is dropped. Country only either way
Computed identifier	The hash must include a site-specific part and a time-based part
Anonymous output	Reports aggregated and shown to the nearest ten, or an analysis that justifies anonymity. No combination of filters may isolate someone. No following of one user’s navigation, so session replay is off
Objection	`optOut()`, or a ready-made button for your privacy page. The visitor’s browser remembers the refusal once they’ve chosen
Vendor as processor	A data processing agreement, no pooling of data between clients, no reuse for its own purposes

Named technical measures are recommendations: an alternative is fine if it’s shown to meet the objective. The grid only answers whether consent can be skipped, and it doesn’t bind the CNIL. A vendor may not call a product “certified” or “validated”, and both controller and processor can be held liable.

This is one regulator’s position. Others may differ, and I haven’t checked them all: if you don’t answer to the CNIL, start from your own authority’s guidance.

A worked example: Trailic against the grid

I ran Trailic’s defaults through this grid, because the exercise shows what the conditions mean in practice. This is my reading of a first version in November 2026: no authority has reviewed it, and Trailic hasn’t published a self-assessment.

Criterion	Trailic as shipped	Reading
Site and time in the hash	Site ID and a daily salt	Matches
Referrer	Host only	Matches
Header data	Stores coarse device, browser, system. The full user agent goes into the hash and isn’t kept	Close, to be argued
Address	Goes into the hash whole, then is dropped. Country only	Differs from the measure named, alternative to be shown
UTM tags	Not kept in anonymous mode. Kept once a site turns it off	Matches, with the mode on
Figures	Exact counts, no rounding	Doesn’t match without an anonymity analysis
Customer IDs, one person’s path	Refused in anonymous mode. With it off, calling `identify` makes the people screen show that person’s activity	Matches with the mode on. Turning it off and calling it puts you outside
Objection	`setConsent(false)` stops collection, but your site must remember the refusal	Your job
Assistants, API	Optional	Ask whether this counts as an integration
Keeping data	Raw events 90 days by default, 730 at most. Daily counts stay	Fits the recommended limit for raw events
Processor	None for Trailic itself. Your host is one, and the CNIL warns about transfers outside the EU	Check your host

So a default install still doesn’t tick every box: figures are exact counts, and I won’t tell you it’s exempt. Funnels and retention that follow someone across days rest on identify, which needs anonymous mode turned off, per site, on the site’s page.

Three setups

What you do	What I’d assume
Cookies or IDs shared with an ad platform, data reused by the vendor	Consent needed. The CNIL says offers where vendors reuse data fall outside the exemption
Page counts only, on your own instance, configured to the grid, with a mention and an objection link in your privacy policy	The exemption may be within reach in France. Document your analysis
Identified people, retention, campaign measurement	Ask for consent, or get advice

A banner is also rarely about analytics alone. An ad pixel or a video embed that sets its own trackers may need one anyway.

If you decide to ask, the library holds everything in memory and sends nothing until you say yes:

// accepted comes from your own banner, and your site remembers it
<Trailic siteKey="site_…" endpoint="https://your-instance.example/api/e" consent={accepted} />

What to tell visitors

An exemption still leaves you owing an explanation. A starting point, to adapt and check:

We count visits to this site with our own analytics instance. It sets no cookies. Our server combines a shortened form of your IP address and your browser details with a value that changes every day to produce an identifier that lasts one day and works on this site only. Neither is stored. We use this only to know which pages are read. You can object here: [link].

The rules may change

In November 2025 the Commission proposed changing these rules through the Digital Omnibus, procedure 2025/0360(COD). When I checked, Parliament’s Legislative Observatory showed “Awaiting committee decision”, so it isn’t law. For your own analysis, see what’s collected on the privacy approach page and how the hash works.

Where Trailic stands

Trailic is a first version. It works end to end on a test instance with real browsers, a real assistant and five million synthetic events, but it hasn’t collected real traffic yet. Its Vercel Queues buffer has only run against a stand-in for that service, its data model may change, and there’s no upgrade path between versions. There’s no hosted version, and the library isn’t on npm yet: it lives in the repo at packages/trailic. Don’t make it your only analytics yet. The code is on GitHub. If my reading of the grid is wrong, say so in the issues.