Does cookieless analytics need consent in the EU?

Cookieless analytics is not exempt just for lacking a cookie: having no cookie is not the test. The ePrivacy rule asks whether you store information on a visitor's device or gain access to information already there, and a script that makes the browser send details out can count as the second. The sources then split. The EU-wide text has no analytics exemption, the European Data Protection Board (EDPB) treats scripts as possible access without deciding the exemptions, France exempts audience measurement under conditions, and Germany adds no analytics exception of its own. This is a technical reading of published sources on 16 October 2026, not legal advice.

Method

We did two things. First we read the primary texts and saved dated notes, and gave each source a weight label: EU law, EDPB guidance, a national regulator, or a vendor describing its own product. Where sources disagreed we kept both sides and marked the point as contested.

Second we opened sites and test pages in a fresh headless Chrome 155 with a new profile and no extensions, from Bulgaria, with no clicks, waiting 10 to 14 seconds. For each page we recorded the hosts contacted, the cookies, and the localStorage and sessionStorage keys. As a control we opened a page that sets a cookie on purpose, and the tool recorded it, so a result of "none" can be trusted to mean none.

Results

What the law text and the guidance say

The rule lives in Directive 2002/58, known as the ePrivacy Directive, at Article 5(3), which is binding EU law. A visitor must agree before you store information on their device or reach information already kept there, unless one of two exceptions applies: passing a message along, or what a requested service strictly needs. The wording says "information" and not "personal data", and nowhere does it carve out analytics (Directive 2002/58).

The EDPB (guidance, not binding law) reads the rule widely. In its Guidelines 2/2023, a script sent to the browser can be the instruction that makes the browser hand something back, and that counts as access. Information produced locally is not excluded once client-side code passes it on to a server. The same document states that it does not decide which uses are exempt, which is left to national law and regulators (EDPB Guidelines 2/2023, paragraphs 32, 51 and 53, and paragraph 4).

France (national regulator) lets audience-measurement cookies skip consent when conditions hold: inform users, offer an objection, restrict use to measurement and A/B testing, never combine with other data, stay within one publisher, shorten the IP address by its final byte, and cap tracker life at 13 months. The same sheet warns that most large measurement offers fall outside the exemption whatever their settings (CNIL sheet 16). That sheet dates from June 2020; the regulator's consolidated cookie recommendation of January 2026 still gives thirteen months as the example lifetime (CNIL recommendation, in French). Germany (national law) copies just the two exceptions into section 25 of the TDDDG, so analytics gets none there (TDDDG §25).

One more item is only a proposal. The Commission's Digital Omnibus of 19 November 2025 would add a GDPR Article 88a, with an exemption for aggregated audience measurement run by the site's own controller for its own use (COM(2025) 837). On 17 October 2026 the Parliament's file for it, 2025/0360(COD), still read "awaiting committee decision", after a committee draft report in June and amendments tabled in July, so the wording can still change and none of it is law yet (Legislative Observatory).

What a fresh browser showed

Cloudflare Web Analytics. On three Next.js sites, including ours, the beacon left no cookie and no localStorage or sessionStorage entry. But it did send a POST to cloudflareinsights.com with the browser engine, engine and browser version, OS version, JavaScript memory sizes, paint and load timings, the full page address, and a random id that is new on every page load. So "no cookies" held, and "reads nothing from the browser" did not. Cloudflare's own page says the beacon stores nothing in the browser and reads no storage (Cloudflare); our measurement does not contradict that, it shows what the script reads from the browser's performance data and sends. Whether such timing data counts as information kept on the user's device is a question none of the sources we fetched answers.

Google Consent Mode. On our local test page with a made-up measurement id, the consent default was set before the tag and all four values were denied. No Google Analytics cookie appeared, yet a hit still reached Google marked gcs=G100, the code for denied storage. With the default set 3 seconds late, the two _ga cookies showed up immediately and Google received the hit without that mark. The order of the lines is visible in the browser. Google's guide says the default must come before any command that sends data (Consent Mode guide); the denied-case ping is what its advanced mode does, and Google's pages do not say whether that ping needs consent.

YouTube. The normal embed, never played, set five youtube.com cookies and contacted two doubleclick hosts before any click. The privacy-enhanced embed left no cookie and skipped doubleclick, yet its frame saved two localStorage entries and reached out to several Google hosts. "Nocookie" in the address is therefore not "nothing stored". IndexedDB we did not look at. YouTube's help page promises that views in that mode do not shape recommendations or ads, and it says nothing about storage (YouTube).

Fonts. A Google Fonts <link> sent the browser to two Google font hosts, without any cookie. next/font/google caused zero requests to Google on our two sites that use it, since the files are downloaded during the build and delivered from the site itself (Next.js).

What removes the question, and what to decide

The safest setup in every country is to load a tracker or an embed only after the visitor agrees. Self-host fonts. Do not read a nocookie address as a promise about storage; measure it. For the analytics itself, the choice depends on where the visitors are. In France, you can argue the exemption if you meet each condition and your provider fits them. In Germany, the statute offers analytics no exemption to lean on. For Bulgaria and other member states we did not check the local regulator, and that check comes before any decision.

A side result: a model test

While building a review skill, gdpr-cookie-consent-review, we wrote 32 consent setups: 27 with one planted problem and 5 sound. Sonnet and Haiku each reviewed every one, once with the skill and once without. Both found the planted problems without it: Sonnet 32 of 32 either way, Haiku 32 of 32 without and 31 of 32 with. So the skill did not find more.

The answers differed in length and drift. Without the skill, answers averaged 823 words for Sonnet and 731 for Haiku, against 148 and 127 with it. Without it, 14 of 32 answers from each model raised data transfers that nobody asked about, and privacy-notice duties came up in 21 of 32 for Sonnet and 30 of 32 for Haiku; with it, none did. Some answers without the skill said they were citing regulators from memory.

What we did not measure

• No lawyer or regulator has read this. It is a reading of published texts, and a regulator's view of a given site may differ.
• One browser, one day. A single headless Chrome, on 16 October 2026, from Bulgaria. Another version, another country or another day could show other requests.
• Bulgaria and most member states are unchecked. We read the EU texts, France and Germany only.
• The central question stays open. No source we fetched says whether timing and browser data read by a beacon falls under the access rule at all. We report the disagreement, and we do not settle it.
• The setups are ours, one run each. We wrote all 32 setups, and another run could move a score. Haiku's single miss was an extra finding on the session-recorder case.
• Vendor statements are dated. Pages of Google, Cloudflare and YouTube change; if one disagrees with this post, believe the page.