Do you need a cookie banner for web analytics?

When does web analytics require a cookie banner?

When the analytics tool stores something on your visitor’s device or reads something from it. That is the test in § 25 TDDDG, the German law that implements the ePrivacy rule on terminal equipment. It does not say “cookie”. It says storing information on the device, or accessing information already stored there. Both need consent, with narrow exceptions for things that are strictly necessary for the service the visitor asked for.

In our reading, analytics does not fall under that exception. Your visitor did not ask to be counted. So the moment your tool writes a cookie, drops an ID into localStorage or reads out device details to build a fingerprint, you are in consent territory. The banner is not a formality on top of that. It is the mechanism that collects the consent the law requires.

Turn the test around and you get the answer to the headline question. A tool that writes nothing and reads nothing beyond what the browser sends with every request does not trip § 25 TDDDG. In our assessment, that tool needs no banner. The rest of this page explains why we believe that, where the remaining risk sits, and when you do need a banner after all.

Last checked: September 2026.

Why does Google Analytics need consent and cookieless analytics not?

Because Google Analytics 4 sets a first-party cookie called _ga to recognise a visitor across visits. A cookie is information stored on the device. Under § 25 TDDDG that requires consent before the cookie is set, and that is why a site running GA4 shows a banner. The data is then processed by Google, which is a separate question under the GDPR, but the banner requirement comes from the cookie itself.

Creo Analytics in cookieless mode sets no cookie, uses no localStorage and touches nothing on the device. The browser sends a request, the server counts it, and nothing comes back to be stored. There is no cookie to consent to. If you are weighing the two tools, the comparison with Google Analytics lists the architecture differences side by side.

What is the legal basis without consent?

Two laws apply, and they answer different questions. § 25 TDDDG asks whether you may touch the device. The GDPR asks whether you may process the data that arrives. For cookieless analytics, our assessment is: the first question does not arise, because nothing on the device is stored or read. The second is answered by Art. 6(1)(f) GDPR, legitimate interest. You have a legitimate interest in knowing whether your website works. The intrusion is minimal, because no IP address is stored and no visitor can be recognised beyond a single day.

We say “our assessment” on purpose. Supervisory authorities in Germany do not apply § 25 TDDDG uniformly to every detail. One open point is whether reading the browser’s user-agent string, which every web server sees anyway, counts as accessing the device. The salted daily hash that Creo Analytics uses is established practice, but it is not a zero-risk construction, and we would rather tell you that here than in the small print. If your website handles sensitive data or you are a professional bound by secrecy, have a lawyer look at your setup. This page is not legal advice.

How do you count visitors without a cookie?

With a hash that changes every day. The server takes a random salt, the website ID, the IP address and the user agent, computes a hash, and discards the IP. The salt lives only in memory and is replaced at midnight. The result is a pseudonym that is valid for one day and cannot be traced back to a person. Across days, visitor totals are estimated with a HyperLogLog sketch, which keeps the error below 3 % and stores no list of visitors at all. The cookieless analytics explainer walks through the method step by step.

What you give up is recognition. Creo Analytics in cookieless mode cannot tell you that Tuesday’s visitor came back on Thursday. It cannot build a person profile, and it cannot feed a retargeting campaign. It can tell you how many people came, from where, on which device, how far they scrolled, where they clicked, and where your funnel leaks. For most websites that is the whole question.

A cookie banner is not the price of analytics. It is the price of a design decision: wanting to recognise people. Give up the recognition and the banner goes with it.

What about visitors who do not want to be counted at all?

They can say so, and the script listens. If a browser sends the Do Not Track signal or Global Privacy Control, Creo Analytics discards the event. It never reaches the database. This happens twice: client-side in the measurement script, and server-side on the request header, which is on by default. On top of that there is a public objection page at platform.creoanalytics.com/widerspruch, which explains in plain language what is recorded and what is not.

Legitimate interest always comes with the right to object under Art. 21 GDPR. A tool that offers no way to object is not on solid ground. Honouring DNT and GPC is how Creo Analytics makes the right usable without asking every visitor a question first.

When do you still need a banner?

When you switch to “full” mode. That mode sets a first-party cookie after opt-in, recognises returning visitors, allows multi-day analyses and can record sessions as a masked replay. Every one of those features stores or reads something on the device, so § 25 TDDDG applies, and the legal basis for the processing becomes consent under Art. 6(1)(a) GDPR. A banner that asks before anything is set is mandatory, and withdrawing consent has to be as easy as giving it.

The useful part: the “full” script behaves exactly like the cookieless one until consent arrives. Before consent, and for every visitor who declines, it measures cookieless. Nobody disappears from your statistics because they clicked “no”. Switching modes happens in the dashboard behind a deliberate gate: three separate confirmations and your domain typed out. Websites hosted with Creo Digital get the matching script automatically; everywhere else you swap one script line for the other. The documentation shows how to wire your consent banner to the creo.push interface and how withdrawal works.

What does that mean for your website?

If you only need to know whether your site works, you can run analytics without a banner today. Two duties stay with you. First, mention the analytics in your privacy policy; a copy-ready text block and a data processing agreement come with every Creo Analytics account. Second, keep the objection route reachable, which the DNT and GPC handling and the objection page take care of. Everything else is a decision about how much you want to know versus how much you want to ask. If you are curious how many people actually mind the banners, the cookie banner poll is a live count, no cookies involved.