Blog · 2026-08-11
Cookieless analytics — the platforms that need no cookie banner
By the howsafeismyapp team · Updated 2026-08-14
Most indie apps add Google Analytics by reflex, then bolt a consent banner on top, then watch half their visitors click "decline" — and end up with numbers that are both legally shaky *and* statistically useless.
There's a cleaner path: cookieless analytics — platforms that don't need consent in the first place, because they never store anything on the visitor's device. This is the setup we run on this site, so what follows is first-hand. (Practical guidance, not legal advice.)
What the law actually requires
Two separate rules meet here:
- § 25 TDDDG requires consent for storing or reading anything on the visitor's device — cookies, localStorage, fingerprinting — unless strictly necessary for the service. Analytics is never "strictly necessary."
- Art. 6 GDPR requires a legal basis for processing personal data — and IP addresses are personal data.
The consequence: a tool that sets no cookies, stores no device identifiers, and doesn't build individual profiles avoids the § 25 consent trigger. For the GDPR side, aggregate-only measurement is commonly run on legitimate interest (Art. 6(1)(f)) — disclosed in the privacy policy, not behind a banner. Tools that track individuals across sites (GA4, Meta Pixel) can't use this path: third-party tracking service embedded.
The options that qualify
- Plausible — EU-hosted, cookieless, aggregates only; scripts and events can be proxied through your own domain so the browser never talks to a third party at all. This is what this site uses.
- Fathom, Simple Analytics — same category: cookieless, EU-privacy-first, paid.
- Umami (self-hosted) — free and fully first-party; you run the (small) infrastructure yourself.
- Vercel/Netlify analytics — cookieless and server-side-ish; fine for basic traffic numbers if you're on those platforms anyway; still name the processor in your privacy policy.
What disqualifies a setup: persistent visitor IDs, cross-site tracking, marketing attribution cookies. If you need those, you need consent — properly, *before* anything fires: tracking loads before anyone could consent.
Keeping the setup honest — three details people skip
- Proxy the script if you claim "no third parties." Even a cookieless script loaded from
plausible.iois a third-party request carrying visitor IPs. Proxying through your own domain (Plausible documents this officially) makes the claim true and dodges ad-blockers as a side effect. - Name the processor in your privacy policy. No banner ≠ no disclosure. Art. 13 wants processors listed — one sentence: what a privacy policy actually requires.
- Don't sneak event-level PII in. Cookieless tools stay banner-free only while you send anonymous events. Put an email address or user ID into a custom event and you've rebuilt the problem you avoided.
The exact setup we run
Concretely, on this site: Plausible, proxied through our own domain. The script is served from /stats/js and events post to /stats/event; our server forwards them on. Your browser never opens a connection to plausible.io, which is what lets us say "no third-party requests" and have it be literally true rather than nearly true.
Two consequences worth knowing before you copy it. First, because the request now arrives from our server rather than the visitor, we forward the visitor's IP so the platform can still count unique visits — that is a processor relationship and it belongs in your privacy policy, named. Ours names Plausible, in the analytics section, with the legal basis. Second, proxying means ad-blockers stop eating your numbers, which is a bigger accuracy gain than most people expect.
Total cost of the setup: one small proxy route, no banner, and no consent-gated data loss.
What you give up — and don't
You lose: demographic profiles, cross-site attribution, remarketing audiences. You keep: page views, referrers, campaigns (UTM), goals/conversions, countries, devices — which for an indie app is every number you'll actually act on. And 100% of visitors are measured, versus whatever fraction accepts a banner: cookieless numbers are routinely *more* accurate than consent-gated GA4 numbers.
Common questions
Is Google Analytics 4 illegal in the EU?
Not per se — but it requires prior consent, and several EU DPAs have found configurations of it unlawful over US transfers. Run properly (consent first, IP settings, DPA), it's defensible; run the way most templates ship it, it's the single most common finding our scanner sees: tracking cookie set without consent.
Do I need a banner for *any* cookies at all?
No — strictly necessary cookies (login sessions, carts, a consent-choice cookie itself) are exempt under § 25 TDDDG. A tool-style app with cookieless analytics and no marketing tags legitimately needs no banner: the full decision tree.
How do I know what my site currently loads?
From the outside: open a private window with DevTools → Network and watch the first page load — or let our scanner do it, which flags every third-party request and early-firing tracker among 15 checks, free and passive.