Analytics tools that need a banner: GA4, Hotjar, Mixpanel, Amplitude, Heap and Adobe

Most mainstream analytics tools set first-party cookies by default: GA4 sets _ga for two years, Adobe Analytics sets s_ecid and s_vi, Heap sets _hp2 or _hp5 cookies for about 13 months, Amplitude sets AMP_ cookies and Mixpanel keeps its ID in a cookie. In the EU, that storage normally requires consent before the script runs.

Updated October 25, 2026

What each tool stores and sends

Browser storage and data flow, from each vendor’s docs
Tool	Stores in the browser	Sends or keeps
Google Analytics 4	_ga (2 years, distinguishes users); _ga_<container-id> (2 years, session state); more when linked to Google Ads	Visit data to Google; with “Google products & services” sharing on, Google may use it to improve its products. No IP logging for EU, Swiss or UK users
Adobe Analytics	s_ecid (13 months); s_vi (2 years, first-party or third-party on omtrdc.net); s_fid fallback ID (2 years)	Each visitor ID is associated with a visitor profile on Adobe servers, deleted after a year of inactivity
Heap	First-party _hp2_id or _hp5_meta user cookies (13 months minus a day); a 30-minute session cookie	User and session identifiers to Heap
Amplitude (Browser SDK 2)	AMP_<key> session cookie; AMP_MKTG_<key> with UTM parameters, referrer and click IDs such as gclid and fbclid	Events to Amplitude; local storage can replace cookies
Mixpanel (JavaScript SDK)	A cookie holding the distinct ID and super properties, shared across subdomains; local storage as an option	Page views with URL path and query string to Mixpanel
Hotjar	We could not retrieve Hotjar’s current cookie list for this note	Session recordings and heatmaps; named in session replay suits

Where that needs consent

In the EU, storing or reading an identifier on the device needs consent unless an exemption applies, and switching these SDKs from cookies to local storage does not change that: the EDPB treats both alike. The CNIL’s audience-measurement exemption in France also requires that the vendor not reuse the data for itself and that nobody is tracked across sites, so check each tool’s configuration against it.

In the US, no state law requires an opt-in banner for any of them. The risk is litigation: Adobe, Google and the replay tool Quantum Metric were among the trackers named in the Kaiser settlement, and session replay that captures typed text is the highest-risk category. A working banner is also the strongest defense there.

Turning them down rather than off

GA4: consent mode stops cookie storage for visitors who refuse and sends cookieless pings instead.
Amplitude and Mixpanel: both can store their IDs in local storage, which changes the mechanism but not the EU consent analysis; Amplitude documents an opt-out of storage altogether.
Replay tools: mask form fields and switch replay off on pages with sensitive input.

Or replace the tool: the cookieless entries in this guide record license, hosting and price for each.

Editor’s pick:OnyxMetric

If you are replacing a tracker, OnyxMetric is the tool this guide picks. What it does by default:

Its script sets no cookies.
With the default settings it does not keep IP addresses and salts visitor IDs daily.
Session replay and form tracking stay off until you turn them on; most options are configurable per site.
It can run through a first-party proxy on your own domain.
Its privacy policy says data is never sold, shared with advertisers or used for model training.
It is hosted on AWS in the United States.
When session replay is on, it masks form inputs.

Try OnyxMetric free for 7 daysmade by this guide’s publisher

Disclosure: OnyxMetric is made by the publisher of this guide. It is recorded with the same field marks as every other tool, and links to it carry a referral tag so we can count visits.

Sources

This note is general information compiled from public sources, not legal advice. Laws and cases change; ask your own counsel before you rely on it.