Most cookie banners protect nothing. They exist because a site loaded an analytics script that plants an identifier on your device. The site owner often wants only one number: how many people visited.
There is a better path. This article explains what the law actually regulates, what changed in the UK in 2026, and how to measure traffic without a consent banner. It is not legal advice. It is a map, with sources, so you can check your own position.
Disclosure: I run Nippy, a static hosting service with built-in cookie-free analytics. I explain below how it avoids the consent trigger. The same logic applies to any tool built the same way.
The law does not say "cookies"
The UK and EU rules regulate storage and access on the user's device. A cookie is one example. The rules also cover localStorage, tracking pixels, scripts and device fingerprinting. The UK regulator lists these technologies explicitly in its guidance on storage and access technologies.
This has two consequences:
- You cannot escape the rules with a fingerprint instead of a cookie. Fingerprinting is in scope.
- Analytics that stores nothing on the device, and reads nothing from it, avoids the main trigger.
That second point is the foundation of cookie-free analytics.
How cookie-free analytics works
A cookie-free system counts on the server. The request itself carries enough for aggregate statistics:
- The page that was requested.
- The referrer header.
- The user agent, for browser and bot detection.
- The country, derived from the IP address and then discarded.
The system does not set an identifier. It does not read one. It does not build a profile of one visitor across days or across sites. It produces totals: views, visitors, sources, countries. Individual people are not the product; the aggregate is.
This is how the analytics in Nippy works: views, visitors, sources, countries and realtime, with bots filtered out, switched on per site — and no banner, because there is nothing on the device to consent to.
The UK in 2026: the rules caught up
Until recently, UK law (PECR) required consent for almost all analytics storage. The Data (Use and Access) Act changed this. The ICO finalised its updated guidance in April 2026. There is now an explicit statistical purposes exception.
The exception lets you collect usage statistics without consent. Four conditions apply:
- Sole purpose. You collect the information only to understand use of the service and to improve it.
- Aggregates, not individuals. You must not monitor or track individual visitors.
- Third parties as processors only. Your analytics provider can act only on your behalf. It cannot reuse the data.
- Transparency and objection. You must tell users clearly what you do, and give them a simple, free way to object.
Note what this means in practice. In the UK, even cookie-based first-party analytics can now run without a consent popup, if you meet all four conditions. And cookie-free analytics meets the first three by design; you still owe users a clear notice and an opt-out. A short section in your privacy page can do both jobs.
The exception does not cover advertising, profiling or cross-site tracking. Those still require consent.
The EU: stricter, and read the fine print
The EU ePrivacy rules still require consent for storage and access, with no general analytics exception. Some countries carve out narrow exemptions — France's CNIL permits strictly-configured audience measurement, for example — but there is no EU-wide rule you can rely on.
There is a second thing to know. The European Data Protection Board read the scope of the rules broadly in its guidelines on Article 5(3): techniques such as pixel tracking, URL decoration and some IP-based tracking can fall in scope even without a classic cookie.
The honest summary for EU traffic: analytics that stores nothing and reads nothing from the device is in the strongest possible position, but "cookie-free" is not a magic phrase. A tool that quietly fingerprints devices to make its visitor counts is not exempt anywhere. Ask your vendor what the visitor count is made from.
GDPR still applies
The consent-banner question and the GDPR question are separate. If your analytics touches personal data at any point — an IP address in a server log is personal data — GDPR applies to that processing. For aggregate statistics this is normally manageable: legitimate interests as the basis, minimal data, short retention, and no attempt to identify anyone. But it is a real obligation, not a footnote. Your privacy page should describe it.
A checklist
Before you remove your banner, check these:
- Your analytics sets no cookie and uses no localStorage. Verify in DevTools, not in the sales page.
- It does not fingerprint. Ask the vendor how visitors are counted.
- It reports aggregates only. No individual visitor timelines.
- Your privacy page explains the measurement, and offers a way to object.
- If you serve EU traffic, check the position of the relevant national regulator.
- Everything else on the site that stores or reads device data — embeds, fonts, ad scripts — has its own trigger. The banner question is about the whole page, not one script.
The last point catches people. A privacy-clean analytics tool does not license a page full of third-party embeds.
Why this matters beyond compliance
A banner is friction for every visitor, to enable measurement that most sites barely use. Removing it is one less interruption, one less script, and one less thing to get wrong. Privacy-respecting measurement is also simply easier to defend — to your users, and to a regulator.
If you want to see the cookie-free approach in one place, Nippy ships it by default with every site, and the help center explains exactly what is measured. Open your own DevTools on a Nippy site and check the cookie jar. It is empty.
This article describes the position in July 2026. Laws change, and their application depends on your facts. For decisions that matter, speak to a lawyer.
Related reading
Top comments (0)