Do You Need a Cookie Banner for a Visitor Counter or Analytics? (2026)

Consent Requirements by Tracking Method

The legal trigger in the EU is Article 5(3) of the ePrivacy Directive: storing information on a user's device, or accessing information already stored there, requires prior consent unless it's strictly necessary for a service the user asked for. Notice what that sentence doesn't say. It doesn't say "cookies", and it doesn't say "personal data" — it says device storage and access. Here's how that maps onto the techniques you'll actually run into:

Two things jump out of that table. First: "first-party" is not a magic word. I keep meeting site owners who believe GA4 got a pass because its cookies live on your own domain — nope. GA4 uses first-party cookies and still generally needs consent in the EU, which is one of my longer-running grievances with how Google communicates this stuff. Second: swapping cookies for localStorage or fingerprinting changes nothing legally. The directive was deliberately written around the mechanism-neutral idea of device storage and access, so the clever workaround you're thinking of was closed off before you thought of it…

Why a MapMyVisitors Counter Doesn't Ask for Consent

MapMyVisitors (our own tool) is a free map widget that shows where your visitors come from, and I built it to sit firmly in that "cookieless server-side" row of the table:

• Location comes from the request, not the device. When the widget loads, the server sees the request's IP address and resolves it to a country and city with a geolocation database. That lookup happens server-side; nothing extra is collected from the browser.
• No third-party tracking cookies. The widget doesn't plant identifiers on your visitors that follow them across other websites.
• No fingerprinting. The widget doesn't probe canvas, fonts, or hardware to build a device signature.

Because the widget stores nothing on the visitor's device and reads nothing from it, embedding it generally doesn't create a consent-banner obligation on its own. The trade-off is honest, and I'll state it plainly: without a persistent identifier you get visit counts and geography, not perfect unique-visitor deduplication across weeks. For a public counter and map, that trade is worth it every time. For a broader look at what counters can and can't measure, see my guides to website visitor counters and visitor counting metrics.

One caveat that applies to every embedded widget, mine included: check the rest of your stack. A cookieless counter doesn't neutralize consent obligations created by other scripts on the same page. I once audited a site whose owner swore it was banner-free-by-design, and an embedded video player was quietly setting three cookies on load (the owner was me, and the site was mine).

Analytics Tools That Work Without a Cookie Banner

If you want full analytics — pages, referrers, campaigns, trends — rather than a public counter, a whole category of privacy-first tools counts visitors the same cookieless way. Every tool below works without cookies or fingerprinting, so none generally requires a consent banner by itself. Prices, trials, and limits in this table were verified against the vendors' pricing pages in July 2026. If you want the full eight-tool bake-off with screenshots, I keep it on a separate page: the best cookieless analytics tools. The short version:

I Put Five Cookieless Tools Through the Same Test

Comparison tables are where marketing goes to hide — mine included. So I put the five hosted contenders — Plausible, Fathom, Simple Analytics, Umami, and Statable — on the same scratch page — a spare domain I keep for experiments. Same routine: install the snippet, load the page in a private window, check the Network tab (how many bytes did the tracker send?) and the Application tab (anything in Cookies, Local Storage, Session Storage?). All five came back with empty storage panels… so the banner question is settled; what separates them is price, limits, and the small stuff you only notice by running them.

Plausible is the tool that convinced a lot of us this category was real: fully open source with a self-hostable Community Edition, all-European infrastructure, GA import even on the cheapest plan, and a 30-day no-card trial. On my test page the script transferred 1,271 bytes — lighter than the 2.5 KB gzipped their own comparison page claims. Plausible nearly won this bake-off… then I counted my domains. The $9 Starter covers exactly one site; $14 Growth covers three. I run six.

Fathom pioneered privacy-first analytics, their EU Isolation setup keeps EU visitor data on EU infrastructure, and every plan includes at least 50 sites — genuinely generous. Storage check: clean. Two catches, though: the pricing page leads with $45/mo at 500K pageviews (lower tiers exist, but that's the headline), and the trial runs 7 days… mine expired before the test site had enough traffic to judge.

Simple Analytics, out of the Netherlands, takes the hardest privacy line of the group — the product is built around not collecting IP addresses at all, and my storage check came back clean. There's a free hobby plan with one month of history, and the 14-day trial needs no card. Where it lost me is arithmetic again: paid plans start at €20/mo, more than double what I ended up paying for the same core job.

Umami is the open-source wildcard: cookieless by default, a genuinely pleasant interface, and you can self-host it free or pay for their cloud. Storage check: clean. The honest catch: self-hosting means appointing yourself database administrator — updates, backups, the 2 a.m. disk-full alarm (I've done that dance; my enthusiasm has limits). If you have the ops muscle, it's the best free option on this page.

A sixth tool can't go in the cookieless column without an asterisk: Matomo. It does nearly everything Google Analytics does, and self-hosted it's free — but out of the box it set cookies on my test page. Cookieless mode exists; you configure it yourself, so the compliance homework is yours. Matomo Cloud starts at €29/mo for 50K pageviews. Capable tool, wrong size for a small site.

The Verdict, With Arithmetic

When I sat down and did the numbers for my own little fleet, they pushed me one way. Plausible's $9 covers one site; the $14 Growth plan gets you to three. Statable's $9 covers 10K pageviews across unlimited websites — for anyone juggling half a dozen projects, that's not subtle. Annual billing drops it to $84 — $7/month, a bigger discount than the standard "two months free". The trial runs 30 days with no card (Fathom gives you 7), and .edu, .github.io and .gitlab.io sites are free outright — full access, no billing. No other tool I checked has a free tier like that for education and open-source hosting.

Two more things tipped me. The full script is 2,181 bytes brotli-compressed — not a docs figure, that's what my own network tab reported when I pulled it off their CDN — call it a wash with Plausible. Their newest addition is a stripped-down Nano preset — pageviews and SPA navigation only, composed per site rather than served as a separate file. I measured a live Nano-configured site on August 10, 2026: 648 bytes brotli, the second-lightest real analytics tracker I've ever pulled off a CDN. And the embeddable live widgets — Live Users with a 30-minute trend bar, Top Countries with flags, a visitor map, a rotating 3D globe — are something neither Plausible nor Fathom offers as standalone embeds. Each widget is one script tag, 5–11 KB over the wire, and here's the part that belongs on this page: the widgets are cookieless too, so putting a public stats badge on your site doesn't drag a consent banner in through the back door. Data lives on EU servers in Amsterdam. I compare tracker payloads in my analytics script size benchmark.

Fair is fair — here's when Statable is the wrong answer. It's hosted-only: if your policy (or temperament) requires self-hosting, pick Umami — or Matomo in cookieless mode for the heavier feature set. If you need product analytics (funnels, feature flags, session replay), that's PostHog territory; none of the tools above compete there. And if all you want is a free public counter with a map… folks, you're already on that tool's website.

Whichever tool you pick, campaign attribution still works without cookies: UTM parameters live in the URL, not on the device. My free UTM builder generates tagged links that any of these tools can read.

GDPR vs. ePrivacy: Which Rule Actually Requires the Banner?

These two get conflated constantly, and the confusion produces both unnecessary banners and missing ones. I've watched people slap a consent popup on a static HTML page with zero trackers "because GDPR"… and I've watched others skip the banner on a cookie-laden site "because we're too small to matter". Both got it wrong.

ePrivacy Directive (2002/58/EC, amended 2009)

This is the actual "cookie law". Article 5(3) requires prior consent before storing information on a user's device or accessing information already stored there, unless the storage is strictly necessary for a service the user explicitly requested. It applies regardless of whether the data is personal — a random cookie ID with no name attached still counts. Each EU member state implements the directive in its own national law, which is why enforcement details vary by country.

GDPR (2016/679)

GDPR governs the processing of personal data and applies whether or not cookies are involved. It matters for analytics in two ways. First, when consent is required (by ePrivacy), GDPR defines what valid consent looks like: freely given, specific, informed, and as easy to withdraw as to give — which is why pre-ticked boxes and "by continuing you agree" banners fail. Second, IP addresses are personal data under GDPR, so even a cookieless tool must handle the IP lawfully. The typical approach is processing it transiently for geolocation and then discarding or truncating it, under the legitimate-interest basis, with a line about it in the privacy policy. If you want a live example of that pattern done by the book, Statable is the cleanest one I've found: the IP is anonymized at the edge of their Amsterdam infrastructure — the country is derived before the response even finishes, and the raw address never gets stored — and their compliance page names Article 6(1)(f) legitimate interest as the basis, in writing, rather than leaving you to guess. That's the exact analysis from the paragraph above, implemented as architecture.

The practical takeaway

The banner question is an ePrivacy question: does anything get stored on or read from the device that isn't strictly necessary? If no — as with cookieless counting — there's generally no banner obligation. GDPR obligations (a privacy policy, a lawful basis, data minimization) still apply to whatever data you do process, banner or not. A missing banner and a compliant site can be the same thing; a present banner and a non-compliant site frequently are too…

And here's how to verify a vendor's cookieless claim yourself, because I've learned not to take marketing pages at their word: open your site in a private window with the tool installed, open developer tools, and check the Application tab (Chrome) or Storage tab (Firefox). If Cookies, Local Storage, and Session Storage stay empty for your domain and the analytics domain after a page view, the tool is doing what it says. Takes two minutes. I do it for every script before it touches a production page.

If you'd rather not do that by hand every time, there's now a tool-shaped version of the same check: Statable publishes a free GDPR Checker extension in the Chrome Web Store that audits a page's consent setup and flags third-party trackers firing before any consent is given — the exact failure mode I keep finding on "banner-free" sites. I ran it against my own test pages and it caught the same embedded-video cookies my manual audit did. I still open DevTools afterwards, mind you… trust the automation, verify the automation.

Frequently Asked Questions

Does GDPR require a cookie banner on every website?

No. GDPR regulates the processing of personal data, not banners. The banner requirement comes from the ePrivacy Directive, which requires consent before storing or reading information on a visitor's device for non-essential purposes. A site that stores nothing on the device for tracking generally has nothing to ask consent for.

Do I need a cookie banner if I only use Google Analytics?

In the EU, generally yes. Google Analytics 4 stores first-party cookies (_ga, _ga_*) to recognize returning visitors, and analytics cookies are not considered strictly necessary under the ePrivacy Directive, so prior consent is generally required before they are set.

Are first-party cookies exempt from consent requirements?

No. The ePrivacy Directive does not distinguish between first-party and third-party cookies. What matters is purpose: cookies strictly necessary to deliver a service the user requested are exempt; analytics and marketing cookies generally are not, regardless of which domain sets them.

Does localStorage count as a cookie under EU rules?

Effectively yes. The ePrivacy Directive covers any storing of information, or gaining access to information already stored, on a user's device. That wording covers localStorage, sessionStorage, IndexedDB, and similar mechanisms — switching from cookies to localStorage does not remove the consent requirement.

Is browser fingerprinting a way to avoid the cookie banner?

No. EU regulators have stated that device fingerprinting used to identify or track users falls under the same consent rules as cookies, because it involves gaining access to information on the user's device. Fingerprinting to avoid a banner generally makes the situation worse, not better.

Do visitor counters need cookie consent?

It depends on how the counter works. A counter that sets a cookie or localStorage value to deduplicate visitors generally needs consent in the EU. A counter that derives location from the IP address of the request server-side and stores nothing on the device — like MapMyVisitors — generally does not trigger the banner requirement. If you are migrating from a discontinued counter, my SiteMeter alternatives roundup flags which replacements are cookieless.

Does anonymizing IP addresses remove the need for a banner?

Not by itself. IP anonymization helps with GDPR data-minimization, but the banner requirement is about device storage and access. An analytics script that anonymizes IPs but still sets a cookie generally still needs consent; a script that sets no cookie and does no fingerprinting generally does not, whether or not IPs are truncated.

Can I be fined for not having a cookie banner?

Yes, if your site sets non-essential cookies or trackers without consent — EU data protection authorities have issued fines for missing or non-functional consent mechanisms. If your site genuinely stores nothing non-essential on visitors' devices, there is no consent obligation to violate. Verify with your browser's developer tools rather than trusting vendor marketing.

Sources

What I actually leaned on while writing and re-checking this page — primary documents first, marketing pages last and with suspicion:

• ePrivacy Directive 2002/58/EC, consolidated text (EUR-Lex) — Article 5(3) is the actual banner trigger. Re-read June 2026.
• GDPR, Regulation (EU) 2016/679 (EUR-Lex) — the consent standard and personal-data rules. Re-read June 2026.
• Article 29 Working Party, Opinion 9/2014 on device fingerprinting — the reason fingerprinting sits under the same consent rules as cookies.
• Vendor pricing and documentation pages for Plausible, Fathom, Simple Analytics, Umami, Matomo, and Statable — verified against the live pages in July 2026.
• My own DevTools storage checks on a spare test domain, run July 2026 — methodology described in the tools section above.