The phrase "privacy-friendly analytics" gets used a lot, often by tools trying to sell you something. This article is a factual look at what it actually means, what the regulations say, and what practical difference it makes for your site.
Cookies vs cookieless: what's the difference?
Traditional analytics tools (Google Analytics being the most common) use cookies – small files stored in the visitor's browser – to identify returning visitors and track them across sessions. This is how they build user profiles and attribute conversions over time.
Cookieless analytics tools don't store anything on the visitor's device. They use a combination of request-level data (page URL, referrer, screen size, language) to count visits without identifying individuals. The trade-off: you can't track the same person across multiple visits, but you also don't need their permission to do it.
| Approach | Can track returning visitors | Requires consent banner | GDPR personal data |
|---|---|---|---|
| Cookie-based (e.g. GA4) | Yes | Yes | Yes – cookies are personal data under GDPR |
| Cookieless, no personal data | No | Typically not | No – if no IP addresses or identifiers are stored |
What GDPR actually requires
GDPR doesn't ban analytics. It requires a lawful basis for processing personal data. For cookie-based analytics, that basis is almost always consent – meaning you need a banner, and visitors have to actively opt in before any tracking starts.
The ePrivacy Directive (often called the "cookie law") adds another layer: storing information on a user's device (like a cookie) requires consent unless it's strictly necessary for the service they requested. Analytics cookies are not strictly necessary.
If your analytics tool doesn't set cookies and doesn't process personal data (no IP addresses, no device fingerprinting), the consent requirement typically doesn't apply. "Typically" because regulations vary by country and enforcement is evolving – but the principle is well established.
The real cost of consent banners
Consent banners have a practical consequence that's often overlooked: they reduce your data accuracy. Studies consistently show that 30–60% of visitors either reject cookies or ignore the banner entirely. That means your analytics only see a portion of your actual traffic.
For a site with 10,000 monthly visitors and a 40% consent rate, you're making decisions based on data from 4,000 people. The other 6,000 are invisible. If the people who reject cookies behave differently from those who accept (and there's evidence they do), your data is not just incomplete – it's skewed.
What "no personal data" means in practice
A tool claiming to collect "no personal data" should mean:
- No cookies or local storage on the visitor's device.
- No IP address logging. The IP might be used momentarily to determine country, but it's not stored.
- No device fingerprinting. Combining screen size, browser version, and installed fonts to create a unique ID is still personal data under GDPR.
- No cross-site tracking. Data from your site stays on your site.
If a tool claims to be "privacy-friendly" but still sets a persistent cookie or logs IP addresses, it's not meeting the standard. Check the specifics.
Does cookieless mean less useful?
It depends on what you need. If your business model requires tracking individual users across sessions (building cohorts, attributing conversions over a 30-day window), cookieless tools won't replace that. You'll need cookie-based analytics with proper consent.
But if you need to know which pages get traffic, where visitors come from, how far they scroll, which buttons they click, and whether your conversion goals are being met – cookieless analytics does all of that without the consent overhead.
For most small and medium sites, the question isn't "do I need tracking cookies?" but "do I need the small amount of extra data cookies provide, given the cost of the consent banner?"
Grandma's take: Privacy-friendly analytics isn't about doing less – it's about getting useful data without making your visitors uncomfortable. No cookies means no consent banner, which means you see 100% of your traffic instead of 40%. Grandma believes in seeing the whole picture, not just the bit that agreed to be seen.
Choosing a tool
When evaluating analytics tools, check these specifics:
- Does it set cookies? (Check your browser dev tools after installing it.)
- Does it store IP addresses? (Read the privacy policy, not the marketing page.)
- Where is the data processed? (EU hosting matters for GDPR compliance.)
- Is the script lightweight? (A 45 KB script affects page speed. A 4 KB script doesn't.)
- Can you see the full picture without requiring consent? (This is the practical advantage.)
Grandma Knows is cookieless, collects no personal data, and weighs under 5 KB. But regardless of which tool you choose, now you know what to look for – and what the words actually mean.