Cookieless analytics and GDPR: what to know

Cookieless analytics lowers the amount of data a tracker stores on a visitor's device, which can simplify your obligations. It does not make GDPR go away, and whether you need consent depends on facts about your setup and your country. This is general information, not legal advice.

Fig.*Check your own legal position. This is not legal advice. Sample data, not a real site.

Is cookieless analytics automatically GDPR compliant?

No tool is compliant by itself. Compliance describes how you use a tool: what you collect, why, where it is stored, who can see it, and what you tell visitors. A cookieless tracker is one input to that picture.

In general terms, two separate rule sets often get mixed up:

• Data protection law (GDPR in the EU and UK GDPR in the UK) covers personal data: anything that can identify a person, directly or indirectly.
• ePrivacy rules (the "cookie law") cover storing or reading information on someone's device, which includes cookies but is not limited to them.

Going cookieless generally addresses part of the second. It does not answer the first. If your analytics processes something that could identify a person, such as a full IP address stored long term, data protection duties still apply.

What does Ownlytics store, and what does cookieless mode change?

Using only what our own pages say:

• By default, the script sets first-party cookies on your domain, which keep a sale linked to a visit weeks earlier.
• Cookieless mode sets no cookies or persistent tracking identifiers. Only an explicit opt-out choice is stored locally, if a visitor uses one. Sales link to visits from the same day.
• A third option, cookieless until consent, switches when your consent banner says so. You choose the mode per website.
• Self-hosted data (see install) is stored in your own Cloudflare D1 database. How visitor IP addresses are handled for location lookup is described in our privacy policy, so read it before you write your own. According to our privacy policy, we do not receive your visits, events, sales or customer records; the installer and dashboard contact us only to validate a license key and check versions.

Hosted works differently because we run the service for you, so read the hosted terms and the privacy policy. For retention, you can limit how long raw events and sessions are kept; see data retention. Payments are never deleted by retention.

Example (made-up numbers for illustration)

A small shop sells a $29 template. It sells mostly to people who visit and buy in one sitting. The owner picks cookieless mode, sets event retention to 1 year, and writes a short privacy page saying what is collected and why. That is a coherent, easy-to-explain story.

A different shop sells a $900 course with a three-week decision window. Cookieless mode would hide most of the journey, so the owner uses cookieless-until-consent. Visitors who accept get first-party tracking, and everyone else is tracked without cookies. The tradeoff is less complete data for the second group in exchange for a clearer consent position.

Neither choice is "the legal one." They are two reasonable designs that you would still confirm with your own adviser.

What questions should you ask your lawyer or regulator?

Bring a short list. It speeds things up and saves money.

1. Do we need consent for this specific setup in the countries where our visitors are?
2. Does our analytics process IP addresses, and how long do we keep them?
3. Are we a controller, and is the tool provider our processor? Do we need an agreement?
4. Is our data stored or processed outside the EU or UK, and does that matter for us?
5. What must the privacy notice say about analytics?
6. Do we need a record of processing or an impact assessment?

Many national data protection authorities publish guidance for small businesses. That is usually a good free starting point and it reflects how your own regulator reads the rules.

Fig.What you still learn without cookies. Sample data, not a real site.

What are the common mistakes?

• Assuming "no cookies" means "no consent ever." The ePrivacy side can apply to other storage and reading of device data, and national authorities differ.
• Forgetting the rest of the stack. Your payment provider, email tool, embedded videos and chat widgets each have their own data practices. Analytics is rarely the only thing a banner must cover.
• Copying another site's privacy page. Yours has to describe your actual setup.
• Keeping raw data forever by default. Retention is a choice. Ownlytics defaults to keeping data forever, so set a window if you do not need it.
• Treating attribution and privacy as opposites. You can often have a useful picture with less data. See how to track conversions without cookies for what is kept and what is lost.

When this doesn't apply

Whether GDPR applies to you depends on facts such as where you are based and whom you offer your product to, and other privacy laws may apply elsewhere. Ask your own counsel. If you need a firm legal answer, no blog post can supply it. Rules also change, so check dates on any guidance you read, including this.

At a glance

Keep it simple

If you want to see what the dashboard reports before deciding, look at the live demo. For how junk traffic can distort your numbers whichever mode you pick, see our post on bot and referrer spam.

For what the tracking script collects and how data is kept, see the script docs and data retention. Your privacy policy should match what you actually run.

FAQ

Do I need a cookie banner if I use cookieless analytics?

It depends on your setup, your visitors' countries and how your regulator interprets the rules. We cannot say yes or no for you. Ask your own counsel or national data protection authority.

Is an IP address personal data?

Regulators often treat it that way when it can be linked to a person. Whether and how a tool stores IPs matters, so check the tool's privacy documentation and ask your adviser.

Does self-hosting help with GDPR?

It can simplify matters because the data sits in your own account rather than with a third party. It does not remove your own duties as the one running the tool.

Can I switch modes later?

You choose the mode per website in Ownlytics, so you can change it as your needs change. Remember that switching changes how future sales link to visits.

Keep reading

• Bot and referrer spam: how to filter your analytics
• Conversion funnel for small SaaS: three steps that matter
• Direct traffic explained, and what dark social hides