Do you need a cookie banner for analytics? EU, UK and US in 2026

In the EU and the UK, analytics that store or read information on a visitor’s device need consent unless an exemption for audience measurement applies, and regulators disagree on how far that exemption reaches for cookieless tools. In the US, no general law requires a cookie banner for analytics: you need a privacy policy, plus an opt-out that honours Global Privacy Control if your analytics sell or share personal data.

Below are the rules as of November 3, 2026, from the laws and regulators themselves. We build invisit, a cookieless analytics tool, so we have a stake; where invisit’s position is uncertain, we say so.

The short answer for the EU, the UK and the US

What does EU law say about analytics cookies?

EU law makes consent the default for any analytics that touch the visitor’s device, and analytics is not one of its exemptions. Article 5(3) of the ePrivacy Directive allows “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user” only with consent, after “clear and comprehensive information”.

The only exemptions are transmitting a communication and what is “strictly necessary” for a service the user “explicitly requested”. The rule covers any information, not only personal data.

In Opinion 04/2012, the EU’s data protection regulators found that first-party analytics cookies “are not exempt from consent but pose limited privacy risks”, and suggested lawmakers add an exemption. The Directive still has none.

When analytics process personal data, the GDPR applies on top: a lawful basis, a privacy notice and a processing agreement with your vendor. An IP address can be personal data in a website operator’s hands.¹

Does cookieless analytics need consent in the EU?

Cookieless analytics is not automatically exempt in the EU. The European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3), final version 2.0 adopted on October 7, 2024, read the rule as covering far more than cookies:

• Scripts: JavaScript that “instructs the browser of the user to send asynchronous requests with the targeted information” is access that “clearly falls within the scope” (paragraph 33).
• Pixels and tracking links: sending them counts as storage, at least through the browser cache, and collecting the identifiers they carry is gaining access (paragraphs 50 and 51).
• IP addresses: tracking based on the IP address alone “could” fall under Article 5(3). A home router’s static IPv4 address and IPv6 addresses originate from the user’s equipment, and “unless the entity can ensure that the IP address does not originate from the terminal equipment”, the rule applies (paragraphs 54 and 55).

The EDPB leaves exemptions to national regulators, noting that falling under Article 5(3) “does not systematically mean that consent needs to be collected” (paragraph 56). So a cookieless script is still inside the rule, and the banner question becomes whether your country exempts audience measurement.

Which EU countries exempt analytics from consent?

France exempts audience measurement from consent under strict conditions; Germany’s regulators decline to say it is exempt in general.

The CNIL’s audience measurement page, dated July 4, 2025, exempts trackers used only to measure the site’s audience on behalf of the publisher alone, producing anonymous statistics only, never cross-referenced with other processing or passed to third parties in non-anonymous form, and never following a person across sites or apps. It recommends telling users in your privacy policy, a tracker lifetime such as 13 months that does not extend on each visit, and keeping the data at most 25 months.

Its July 2025 self-assessment grid is stricter than most founders expect. For a fingerprint-style visitor hash, it recommends mixing in something site-specific, such as the domain, and a time component. Its recommended measures also switch off UTM and campaign-ID collection, cut referrers to the domain, rule out following one visitor’s navigation, and put an opt-out link in the privacy policy. Vendors may document alternatives, but may not call a tool “validated by the CNIL”.

Matomo’s CNIL mode shows the cost: it turns off the Visits Log, visitor profiles, User ID, heatmaps and session recordings, discards campaign parameters, masks three bytes of each IP address and deletes raw data after 744 days.

Germany’s section 25 of the TDDDG copies Article 5(3) almost word for word. Its regulators’ guidance for digital services (version 1.2, November 2024) refuses to call reach measurement exempt in general, because “even the simple measurement of visitor numbers” is not part of the basic service “per se” and depends on its purpose (paragraph 90, our translation). It treats reading device properties with JavaScript to build a fingerprint as access (paragraph 24). In Germany, consent-free analytics rests on your own documented argument.

Is a daily rotating hash exempt from consent?

Regulators have not agreed on analytics that count visitors with a daily hash of the IP address and user agent:

Vendors describe their own products, so weigh the regulators first. Either way, a daily hash keeps you inside the GDPR: Fathom’s documentation says it processes “personal data (IP Address and User-Agent)” for its customers.

What changed for analytics cookies in the UK in 2026?

Since February 5, 2026, UK sites can use cookies and similar technologies for analytics without consent, if the analytics are statistical, aimed at improving the site, and visitors are told and can object. Section 112 of the Data (Use and Access) Act 2025, brought into force by S.I. 2026/82, rewrote PECR regulation 6 and added Schedule A1. Its paragraph 5 allows storage or access when:

1. its sole purpose is to collect information “for statistical purposes” about how the service or website is used, “with a view to making improvements”;
2. the information is shared only with someone helping you make those improvements;
3. visitors get “clear and comprehensive information” about the purpose;
4. visitors have “a simple means of objecting, free of charge”, and do not object.

Regulation 6 now also covers “collecting or monitoring information automatically emitted by the terminal equipment”, and paragraph 5(2) keeps that kind of collection out of the statistics exception.

The ICO finalised its storage and access guidance on April 29, 2026. Its exceptions chapter says the exception is about “how your service is used, not about who uses it”:

• Likely covered: visits page by page, scroll depth, device types, referrers and campaigns, A/B tests, city-level location, load speed.
• Not covered: “logs or recordings of individual visitors to your website and the actions they took”, advertising measurement, conversions tied to a visitor ID for ad partners, profiling by IP address, and keeping individual-level information after aggregating it.
• The objection can be an analytics toggle, on by default, in your consent tool. Once someone objects, you stop.

The ICO’s only example of “automatically emitted” information is wifi probe requests. Whether the IP address and user agent of an ordinary page request count is not settled, and that decides how comfortably a hash-based tool fits the exception.

Will the EU drop cookie banners for analytics?

Not yet. As of November 2026 an EU analytics exemption is still a proposal, and the current rules apply in full.

The European Commission’s Digital Omnibus proposal of November 19, 2025 would exempt “creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use”. On October 21, 2026 the Council agreed its position: the rules stay in the ePrivacy Directive, with added consent-free purposes including audience measurement. Negotiations start once the European Parliament adopts its position; its committees had not voted by late October 2026 (Legislative Train).

Do US websites need a cookie banner for analytics?

No. No federal law, and none of the state privacy laws, requires opt-in consent before ordinary first-party analytics. US state laws work on opt-out: people can stop the sale or sharing of their data and targeted advertising, and several states require you to honour Global Privacy Control (GPC) as that opt-out.

• Who is covered: the CCPA applies to a for-profit business with revenue over $26,625,000, or that buys, sells or shares the data of 100,000 or more consumers or households, or makes half its revenue from selling or sharing it (CPPA).
• When analytics become a sale: “sell” includes handing over data for “other valuable consideration”. In 2022 Sephora paid $1.2 million after California’s Attorney General treated letting analytics and ad providers collect shopper data in exchange for their services as a sale, and found GPC ignored.
• When they are not: a vendor acting as your service provider. Google says Google Analytics is one when data sharing with Google products and services is disabled.
• GPC: a business that sells or shares must treat the signal as an opt-out for that browser and any pseudonymous profile tied to it, within 15 business days (CPPA). Colorado has required it since July 1, 2024, Connecticut since January 1, 2025, and California counts itself one of a dozen states with the requirement. The three ran a joint GPC sweep in September 2025.
• Coming next: from January 1, 2027, browsers in California must offer a setting that sends an opt-out signal (AB 566).
• The privacy policy: CalOPPA requires one from commercial sites collecting personal information from Californians, saying how you respond to Do Not Track if you track people across other sites.

Sensitive data is different: Colorado, for one, requires consent before processing it, and health and children’s data have their own rules, not covered here.

What each analytics setup needs in the EU, the UK and the US

GA4 sets _ga and _ga_<container-id> for two years by default (Google), and Google’s EU user consent policy makes you collect consent where the law requires it in the EEA, the UK and Switzerland. To use the UK statistics exception, a GA4 property would at least need Google signals, ads links and data sharing off, plus an objection control.

Consent Mode changes what the tag does after the visitor chooses, not whether you ask. In basic mode, no tags load before the banner is answered. In advanced mode, denied visitors still send cookieless pings with the user agent, referrer and a random number per page load: a script making the browser send information, as in EDPB paragraph 33.

Simple Analytics decides visits from the referrer and keeps no identifier, the most conservative design here. Plausible and Fathom rotate their hash salt daily; Umami rotates its salt monthly by default, so a returning visitor stays linkable for up to a month. DataFast’s default script sets a datafast_visitor_id cookie for a year, and DataFast says you may need a banner for it.

Does invisit need a cookie banner?

invisit sits in the daily-hash row, so the same country-by-country readings apply to it as to Plausible or Fathom. We do not claim it is exempt everywhere. What it does, checked against its code:

• It sets no cookies and stores nothing on an ordinary visitor’s device. The only things it ever keeps there are a consent answer from your banner and a site owner’s own opt-out; storage: 'none' keeps even those off.
• The server tells visitors apart with a keyed hash of your site, the date, the device, browser and operating system type, and the IP address. The date changes it every day, so nobody is followed across days, and raw IP addresses are never stored.
• With respectGpc or respectDnt turned on, browsers that send Global Privacy Control or Do Not Track are not measured at all, which goes further than US law asks.
• With requireConsent, nothing is sent until your banner grants consent. consent('denied') stops collection on that browser in any mode, so it can serve as the opt-out link (privacy guide).

import { consent, init } from '@invisitdev/web'

init({ site: '<site id>' })

// The "stop measuring me" link in your privacy policy
export function optOutOfAnalytics(): void {
  consent('denied')
}

To ask first, start with init({ site: '<site id>', requireConsent: true }) and call consent('granted') from your banner.

Where invisit fits less well:

• France: invisit records UTM campaigns, shows every visit step by step and attaches your user ids through identify(), features the CNIL grid switches off, and it has no CNIL mode. For consent-free measurement of French visitors, Matomo’s CNIL mode fits better; with invisit, use requireConsent.
• UK: the ICO puts “logs or recordings of individual visitors” outside the statistics exception. If your assessment treats invisit’s script as access to the device, its visit timelines strain that exception, and requireConsent is the conservative choice.
• Retention: invisit keeps analytics data until you delete the site; the CNIL recommends 25 months at most.

Checklist: privacy policy, banner or neither

• List every tag on your site: analytics, ad pixels, chat widgets, embeds. One pixel that needs consent keeps the banner.
• In the privacy policy, name the analytics tool and say what it collects, whether it stores IP addresses, how it tells visitors apart, where and how long data is kept, and your GDPR lawful basis, usually legitimate interests.
• Sign your analytics vendor’s data processing agreement.
• Add a free, one-click way to object, such as an opt-out link in the privacy policy. The UK exception requires one and the CNIL grid expects one.
• Keep a banner for EU and UK visitors if you run GA4 or an ad pixel, set an analytics cookie outside France’s exemption, or rely on visitor-level data such as visit timelines, user ids or revenue tied to a visitor.
• In the US, check whether the CCPA covers you; if a tag sells or shares data, add a “Do Not Sell or Share” link and honour GPC.
• Check again in 2027, when the Digital Omnibus and California’s browser signal may change this list.

The trap to avoid is treating “cookieless” as the exemption. Every exemption above comes with conditions, usually notice, an opt-out and aggregate use only, and you meet them in your privacy policy and your setup, not in your vendor’s marketing.