Does cookieless analytics need a consent banner in the EU?

It depends on the setup, not the label. The EDPB reads the ePrivacy rule to cover pixels, local storage and script-built identifiers as well as cookies. A tool can run without consent only where a national exemption, such as the CNIL’s for audience measurement, fits its actual configuration.

Is a “Do Not Sell or Share” link the same as a cookie banner?

No. It is an opt-out under California law, required when you sell personal information or share it for cross-context behavioral advertising. It does not ask for permission before analytics runs, and many first-party analytics setups never trigger it.

What does the UK’s statistics exception require?

Since February 5, 2026, storage used only to produce statistics about your own service needs no consent, provided you give clear information about it and a simple, free way to object. Advertising cookies still need opt-in consent.

Do I need a cookie banner for analytics?

In the US, no state law requires an opt-in cookie banner for analytics; you need a privacy policy, an opt-out when data is sold or shared for ads, and Global Privacy Control support where required. In the EU, the consent rule reaches many cookieless techniques too. The UK now exempts first-party statistics, with notice and an opt-out.

Updated October 25, 2026

The answer by region

Consent banners for analytics, October 2026
Region	Opt-in banner for analytics?	What you still need
United States (state privacy laws)	No state law requires one	A privacy policy and notice at collection; a “Do Not Sell or Share” opt-out if analytics data is sold or shared for cross-context advertising; honor Global Privacy Control signals where state law makes them binding, as California does
European Union (ePrivacy Art. 5(3))	Yes by default, unless an exemption fits	Consent before storing or reading anything on the device, which the EDPB reads to include pixels, tracking URLs, local storage and identifiers built by scripts; some regulators, such as the CNIL in France, exempt narrowly configured audience measurement
United Kingdom (PECR, as amended by the Data (Use and Access) Act 2025)	Not for first-party statistics, since February 5, 2026	Clear information and a simple, free way to object; advertising storage still needs opt-in consent

United States: opt-out, not opt-in

The US model is opt-out. California’s CCPA, as amended by the CPRA, requires notice at collection and a privacy policy, an opt-out of the “sale” or “sharing” of personal information (sharing means cross-context behavioral advertising), and respect for Global Privacy Control browser signals. None of the state laws requires permission before ordinary analytics runs.

Opt-outs are enforced. The California Attorney General settled with Healthline for $1.55 million for failing to honor opt-outs, including Global Privacy Control, while selling article titles that suggested health conditions.

A vendor that processes analytics only for you, under contract and with no use of its own, is generally treated as a service provider rather than a buyer, so analytics alone usually needs only the privacy-policy disclosure. That reading depends on the contract, so confirm it with counsel.

Health data is the exception to the opt-out pattern. Washington’s My Health My Data Act requires opt-in consent and gives people a private right of action; the first class action under it, Maxwell v. Amazon, was filed in February 2025 over an app SDK.

A banner can still matter in the US

Consent is the strongest defense to wiretap claims under California’s Invasion of Privacy Act. Courts dismissed claims where a working banner and privacy policy gave consent (Lakes v. Ubisoft, April 2025; In re Adobe, September 2026). The Ninth Circuit has held that consent must come first: retroactive or implied consent is not enough.

A banner only helps if it works. A pen-register claim against AEG survived because trackers fired before the banner, and broken “Reject all” buttons are now a lawsuit lane of their own. Removing a working banner removes that defense.

European Union: cookieless is not a loophole

The EDPB’s Guidelines 2/2023 (version 2, October 2024) read Article 5(3) of the ePrivacy Directive to cover far more than cookies: tracking pixels and tracking URLs, local processing whose results are sent back, IP-based tracking unless the IP provably does not come from the user’s device, and unique identifiers. Being in scope does not automatically mean consent is required, because exemptions may apply.

The best-known exemption is the CNIL’s for audience measurement in France. A tool qualifies only when:

its purpose is limited to audience measurement for the site publisher alone;
it produces anonymous statistics only;
data is not cross-referenced with other processing, and non-anonymous data is not passed to third parties;
it does not track people across sites (the same identifier on several sites disqualifies it);
the vendor does not reuse the data for its own purposes.

The CNIL’s 2025 self-assessment tool adds detail: IP addresses truncated after city-level geolocation, browser and OS major versions only, referrers reduced to the domain, no campaign (UTM) parameters or CRM identifiers, and any fingerprint kept site-specific and time-limited. The exemption is French law; other EU regulators set their own lines.

United Kingdom: the statistics exception

The Data (Use and Access) Act 2025 received Royal Assent on June 19, 2025. Its section 112 replaced regulation 6 of PECR with a new Schedule A1, and the new cookie exceptions came into force on February 5, 2026.

The statistical-purposes exception covers storage whose sole purpose is producing statistics about the use of your own service so you can improve it. You must give clear information and a simple, free way to object. Advertising still needs opt-in consent, and PECR fines now reach £17.5 million or 4% of turnover.

Editor’s pick:OnyxMetric

If you are replacing a tracker, OnyxMetric is the tool this guide picks. What it does by default:

Its script sets no cookies.
With the default settings it does not keep IP addresses and salts visitor IDs daily.
Session replay and form tracking stay off until you turn them on; most options are configurable per site.
It can run through a first-party proxy on your own domain.
Its privacy policy says data is never sold, shared with advertisers or used for model training.
It is hosted on AWS in the United States.
When session replay is on, it masks form inputs.

Try OnyxMetric free for 7 daysmade by this guide’s publisher

Disclosure: OnyxMetric is made by the publisher of this guide. It is recorded with the same field marks as every other tool, and links to it carry a referral tag so we can count visits.

Questions

Does cookieless analytics need a consent banner in the EU?: It depends on the setup, not the label. The EDPB reads the ePrivacy rule to cover pixels, local storage and script-built identifiers as well as cookies. A tool can run without consent only where a national exemption, such as the CNIL’s for audience measurement, fits its actual configuration.
Is a “Do Not Sell or Share” link the same as a cookie banner?: No. It is an opt-out under California law, required when you sell personal information or share it for cross-context behavioral advertising. It does not ask for permission before analytics runs, and many first-party analytics setups never trigger it.
What does the UK’s statistics exception require?: Since February 5, 2026, storage used only to produce statistics about your own service needs no consent, provided you give clear information about it and a simple, free way to object. Advertising cookies still need opt-in consent.

Sources

This note is general information compiled from public sources, not legal advice. Laws and cases change; ask your own counsel before you rely on it.