GDPR and Cookieless Analytics

Important Notice

Any statement here about how Sealmetrics meets a criterion is a self-assessment, not a certification. No supervisory authority certifies or validates analytics tools, and Sealmetrics holds no third-party security certification (no ISO 27001, no SOC 2). This page is general regulatory analysis, not legal advice.

Cookieless analytics represent a fundamental shift in how websites measure traffic while complying with GDPR. By eliminating persistent user identifiers, cookieless solutions can provide comprehensive analytics without consent banners, consent-driven data loss, or privacy violations.

The GDPR Challenge for Traditional Analytics

Why Cookies Trigger GDPR

Cookies = Personal Data (in most cases):

When a cookie contains a unique identifier that can be linked to an individual—even indirectly—it constitutes personal data under GDPR Article 4(1):

"Personal data means any information relating to an identified or identifiable natural person"

Traditional analytics cookies:

• Unique visitor IDs
• Session identifiers
• Tracking across visits
• Building behavioral profiles over time

Result: Processing personal data requires lawful basis under GDPR Article 6.

Common (Problematic) Approaches

Approach 1: Consent (Article 6(1)(a))

Implementation: Cookie banner requesting consent for analytics

Problems:

• Data loss from visitors who reject or ignore the banner
• Skewed analytics (privacy-conscious users underrepresented)
• Consent fatigue
• Complex consent management
• Cost of consent management platforms

Compliance challenge: Consent must be "freely given, specific, informed, and unambiguous" (GDPR Article 4(11); see EDPB Guidelines 05/2020 on consent)—difficult with cookie walls or dark patterns.

Approach 2: Legitimate Interest (Article 6(1)(f))

Claim: Analytics is a legitimate interest

Problems:

• Must pass three-part test:
  1. Legitimate interest exists ✅ (understanding website performance)
  2. Processing is necessary ❓ (are cookies necessary for analytics?)
  3. Balancing test ❓ (interests vs. rights)
• Data protection authorities skeptical of legitimate interest for tracking cookies
• Right to object must be provided
• EDPB guidance suggests consent is safer route for most cookies

Risk: Supervisory authority or court may reject legitimate interest claim for tracking cookies.

Approach 3: Ignore GDPR (Non-Compliance)

Implementation: Place analytics cookies without legal basis

Consequences:

• GDPR violations
• Fines up to €20M or 4% global revenue
• Enforcement actions
• Reputational damage
• User complaints

Not recommended: High-profile Google Analytics enforcement (Austria, France, Italy) demonstrates authorities are serious.

The Cookieless Solution

What is Cookieless Analytics?

Definition: Web analytics that do not use cookies or similar persistent identifiers to track users across sessions.

Technical approaches:

1. Session-based measurement: Track page views within session, without cross-session linking
2. Server-side logging: Analyze server logs without client-side identifiers
3. Cookieless session identification: Without persistent identifiers (at most a short-lived identifier that rotates and cannot link visits over time)
4. Aggregated metrics only: Count events without identifying individuals

Key principle: Measure the audience (how many, from where, what they do) without tracking individuals (who specifically, what they do over time).

Why Cookieless Complies with GDPR

1. No Personal Data Processing (Ideal Case)

If truly anonymous:

• No unique identifiers
• No linking across sessions
• No individual tracking
• GDPR does not apply (Recital 26: anonymous information not covered)

Example: Server logs counting page views per hour, by country, without any visitor identification.

Advantage: No legal basis required; GDPR inapplicable to anonymous data.

Caveat: any per-visitor identifier — even a short-lived one — that someone holding the key could still link to a device is pseudonymous, not anonymous, and keeps the data inside the GDPR. Truly anonymous measurement is rarer than it sounds.

2. Minimal, Pseudonymised Personal Data (Sealmetrics and Other Cookieless Tools)

Most cookieless tools still process some personal data — a hashed IP address, or a session identifier derived from device characteristics. Both remain personal data while anyone holds the means to link them back. An Article 6 basis is required, and the one these tools rely on is legitimate interest.

This is Sealmetrics' position. Nothing is stored on the device and no IP address is stored (not even hashed). The tracker computes a session identifier in the browser, which the server re-keys with a salt that rotates daily; the old salt is destroyed. During the day Sealmetrics holds key and salt, so the identifier is a pseudonym — personal data under GDPR (Recital 26). After the daily rotation it cannot be reconstructed, not even by Sealmetrics. The per-hit log is purged after 1 day and reports are aggregated. Sealmetrics processes these pseudonymised operational data under legitimate interest, Article 6(1)(f).

Legitimate interest (Article 6(1)(f)) is a stronger case for such tools than for cookie-based tracking:

Necessity test:

• Cookieless measurement is genuinely necessary (no less intrusive alternative exists for basic traffic measurement)
• Purpose is limited and clear

Balancing test:

• Low privacy impact (no profiling, no cross-site tracking, no long-term identifiers)
• User expectations: Reasonable to expect website measures traffic
• Transparency: Easy to explain and understand
• No high risk to data subjects

Outcome: Legitimate interest is likely valid for a minimal cookieless tool — a hashed IP, or a daily-rotating session pseudonym like Sealmetrics' — where it may not be for cookie-based tracking. The less data, the shorter its life and the less linkable it is, the stronger the balancing test.

Where GDPR Article 6 Fits

Article 6 lists the lawful bases for processing personal data. It is only reached if personal data is processed. A truly anonymous dataset (case 1) never reaches it. The table below shows how each basis fares for cookieless tools that still process some personal data (case 2, which includes Sealmetrics):

Legal Basis	Applicability	Requirements
Consent (6(1)(a))	Not needed for cookieless	N/A - no tracking to consent to
Contract (6(1)(b))	Rarely applicable	Analytics not necessary for service delivery
Legal obligation (6(1)(c))	Not applicable	No law requires website analytics
Vital interests (6(1)(d))	Not applicable	Analytics don't protect life
Public task (6(1)(e))	Public sector only	Government websites measuring performance
Legitimate interest (6(1)(f))	Usual basis for tools that keep a hashed IP or a short-lived session identifier	Website operator's interest in understanding traffic, documented in a legitimate interest assessment

For Sealmetrics: legitimate interest (Article 6(1)(f)) for the pseudonymised operational data — the per-hit log and the live session, kept for 1 day. Aggregated reports are non-identifying.

For tools that retain a hashed IP: legitimate interest (Article 6(1)(f)) is likewise the basis most rely on. Either way it has to be documented in the assessment below.

Legitimate Interest Assessment: When It Is Required

Required whenever processing relies on Article 6(1)(f) — including Sealmetrics visitor analytics. A legitimate interest assessment (the three-part test) is the accountability record for that processing. For Sealmetrics it is short: no IP stored, nothing stored on the device, no persistent identifier (only a daily-re-keyed session pseudonym, unrecoverable after rotation, purged from the per-hit log after 1 day), no cross-session linking, aggregated reports.

Also required for identifier-based tools you run alongside. Publishers who operate a cookie-based or hashed-IP tool next to Sealmetrics (a tag manager, an ad pixel, a second analytics platform) need a separate assessment — or consent — for that processing.

Three-Part Test

Part 1: Legitimate Interest

Question: Does the controller have a legitimate interest?

For a minimal analytics tool that still processes personal data (e.g., a hashed IP or a daily-rotating session pseudonym):

• ✅ Understanding website performance
• ✅ Improving user experience
• ✅ Optimizing content
• ✅ Technical operations and security
• ✅ Business planning and development

GDPR Recital 47: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

By analogy: If direct marketing is legitimate interest, certainly understanding website usage is too.

Conclusion: Legitimate interest clearly exists.

Part 2: Necessity

Question: Is processing necessary for that interest?

For a minimal analytics tool that still processes personal data:

• ✅ Cannot understand traffic without measurement
• ✅ Cookieless approach is far less intrusive than cookie-based tracking
• ⚠️ Check for less invasive alternatives: a tool that stores no IP and whose session identifier rotates daily and becomes unrecoverable is less intrusive than one that keeps a hashed IP

Article 5(1)(c): Data minimization—collect only what is necessary

A minimal cookieless tool demonstrates data minimization:

• No persistent identifiers
• No cross-session tracking
• Aggregated measurement
• Short data retention

Conclusion: Processing is necessary, and minimized to what's required.

Part 3: Balancing Test

Question: Do data subject interests, rights, and freedoms override the legitimate interest?

Factors to consider:

Nature of data:

• Basic traffic metrics (not sensitive)
• No special categories (Article 9)
• Minimal personal data (e.g., a hashed IP, or a session pseudonym that rotates daily)

Reasonable expectations:

• Users expect websites measure traffic
• Cookieless is less invasive than expected (no tracking)
• Transparent and understandable

Impact on data subjects:

• Low risk: No profiling, no behavioral advertising, no selling data
• No discrimination: Analytics not used for automated decisions affecting individuals
• No vulnerability: Not targeting children or vulnerable populations

Safeguards:

• Privacy policy disclosure
• Right to object provided
• Data security measures
• Limited retention periods

Conclusion: For a minimal, non-profiling tool, interests do NOT override; legitimate interest is valid. Cookie-based profiling tools rarely get this far.

Legal Position: Cookieless vs. Cookie-Based

Factor	Cookieless Analytics (no IP, no persistent identifier)	Cookie-Based Tracking
Personal data processed	Minimal and pseudonymised (a session identifier that rotates daily) ✅	Yes (persistent unique identifiers) ❌
Article 6 basis needed	Yes — legitimate interest, with a strong balancing test ✅	Yes — consent, or a contested legitimate interest claim ❓
Legitimate interest assessment	Required, and short ✅	Required if relying on 6(1)(f) ⚠️
Privacy impact	Low (no tracking) ✅	High (persistent tracking) ❌
User expectations	Reasonable ✅	Negative (tracking) ❌
Safeguards	Built-in (no persistent IDs) ✅	Requires controls ⚠️

Result: A minimal, pseudonymised cookieless dataset sits comfortably on legitimate interest. Cookie-based tracking needs a basis too, but legitimate interest is questionable for it — consent is the safer route.

GDPR Principles and Cookieless Analytics

Principle 1: Lawfulness, Fairness, Transparency (Article 5(1)(a))

Lawfulness: Legitimate interest (Article 6(1)(f)) for the pseudonymised operational data, documented in a short assessment ✅

Fairness:

• Users not deceived
• No hidden tracking
• Processing aligns with reasonable expectations ✅

Transparency:

• Privacy policy discloses analytics
• Clear explanation of what's measured
• How to exercise rights ✅

Cookieless advantage: Easier to explain ("we count visitors, we don't track you") vs. complex cookie ecosystems.

Principle 2: Purpose Limitation (Article 5(1)(b))

Requirement: Data collected for specified, explicit, legitimate purposes; not further processed incompatibly

Cookieless analytics:

• ✅ Clear purpose: Website performance measurement
• ✅ Limited scope: Traffic statistics for website operator's use
• ✅ No secondary uses: Not sold, not used for advertising, not shared

Compliance: Purpose limitation naturally satisfied by design.

Principle 3: Data Minimization (Article 5(1)(c))

Requirement: Adequate, relevant, and limited to what is necessary

Cookieless analytics:

• ✅ No persistent user IDs (eliminates unnecessary tracking)
• ✅ Aggregated metrics (only what's needed for statistics)
• ✅ No individual profiles (unnecessary for traffic measurement)
• ✅ Minimal, pseudonymised data (no IP stored, no persistent identifier, no cross-session linking; the session identifier rotates daily)

Gold standard: Cookieless is data minimization by design.

Principle 4: Accuracy (Article 5(1)(d))

Requirement: Personal data must be accurate and kept up to date

Cookieless analytics:

• ✅ Aggregate statistics (accuracy inherent in counting)
• ✅ No individual data to be inaccurate
• ✅ Session-based measurement (no stale profiles)

Benefit: Less risk of inaccuracy when not maintaining user profiles.

Principle 5: Storage Limitation (Article 5(1)(e))

Requirement: Kept in identifiable form no longer than necessary

Cookieless analytics:

• ✅ Session-only tracking (no long-term storage of identifiers)
• ✅ Aggregated data quickly (raw logs not retained long)
• ✅ Typical retention: 24 months maximum (align with AEPD requirements)
• ✅ Aggregated reports can be kept indefinitely (non-identifying)

Best practice: Delete raw server logs after aggregation; retain only statistics.

Principle 6: Integrity and Confidentiality (Article 5(1)(f))

Requirement: Appropriate security measures

Cookieless analytics:

• ✅ Less data to secure (no long-term user profiles)
• ✅ Encryption in transit (HTTPS)
• ✅ Access controls
• ✅ Secure infrastructure

Reduced risk: Less valuable to attackers (no persistent user data to breach).

Principle 7: Accountability (Article 5(2))

Requirement: Controller must demonstrate compliance

Cookieless analytics:

• ✅ Document the legitimate interest assessment for the analytics, and separately for any identifier-based tools you also run
• ✅ Maintain records of processing activities (Article 30)
• ✅ Privacy policy reflects cookieless approach
• ✅ Data protection by design (Article 25)

Demonstration: Easier to show compliance when processing is minimal.

Data Subject Rights and Cookieless Analytics

Right of Access (Article 15)

User request: "What personal data do you have about me?"

Cookieless analytics response:

• If the identifier rotates and becomes unrecoverable (Sealmetrics): "Our analytics store nothing on your device and no data that identifies you. The session identifier rotates daily and cannot be reconstructed afterwards, so we cannot match your request to any record (GDPR Article 11)."
• If minimal data (IP in logs): "We have server logs with your IP address from [date/time], used for traffic measurement. This data will be deleted after [retention period]."

Advantage: Simple response; no extensive user profiles to provide.

Right to Rectification (Article 16)

User request: "Correct inaccurate data about me"

Cookieless analytics:

• Not applicable (no individual user profiles to be inaccurate)
• Aggregate statistics are accurate by design

Right to Erasure (Article 17)

User request: "Delete my data"

Cookieless analytics:

• If the identifier is unrecoverable: In practice the request cannot be matched to a person (Article 11); the per-hit log is purged after 1 day anyway
• If IP in logs: Can delete specific IP entries, or explain scheduled deletion period

Practical: Much easier than cookie-based systems tracking users across months/years.

Right to Restriction (Article 18)

User request: "Stop processing my data while we resolve a dispute"

Cookieless analytics:

• Rarely applicable (no ongoing individual processing to restrict)
• Can flag IP for non-processing if requested

Right to Data Portability (Article 20)

User request: "Give me my data in portable format"

Cookieless analytics:

• Not applicable (Article 20 requires processing based on consent or contract; legitimate interest is neither)
• Even if applied: No meaningful individual data to port (aggregate statistics are non-identifying)

Right to Object (Article 21)

User request: "Stop processing my data for analytics"

Article 21 applies to processing based on Article 6(1)(e) or (f) — so it applies to cookieless tools relying on legitimate interest, Sealmetrics included.

Cookieless analytics response:

• If the identifier rotates daily and becomes unrecoverable (Sealmetrics): the right applies, but in practice a request cannot be matched to a person (Article 11). Offer the forward-looking route: not loading the tracker for that visitor (see the options below).
• If minimal data (hashed IP): The right applies. Provide a mechanism (e.g., email address in privacy policy) and honor objections.

Implementation options for tools where the right applies:

1. IP exclusion: Add user's IP to exclusion list (imperfect, dynamic IPs)
2. Browser signal: Respect Do Not Track or Global Privacy Control (Sealmetrics does not read these signals itself; a site can skip loading the tracker when they are present)
3. Manual request: User contacts, we exclude their IP or sessions

Best practice: Make objection easy and effective where it applies.

Cookieless Analytics and ePrivacy

ePrivacy Directive Article 5(3)

Separate from GDPR: Article 5(3) of Directive 2002/58/EC regulates terminal equipment access (cookies, device fingerprinting)

Requirement: Consent for storing/accessing information in terminal equipment

Exception: Strictly necessary for service delivery

Cookieless and ePrivacy Compliance

Key question: Do cookieless analytics access/store information in terminal equipment?

If NO cookies or client-side storage, and nothing is read from the device:

• ✅ ePrivacy Directive does not apply
• ✅ No consent required under ePrivacy

If nothing is stored but the script reads browser properties (for example, to compute a session hash — as Sealmetrics does):

• Reading those properties is "access" under Article 5(3), so the provision is engaged
• The consent exemption then depends on the audience-measurement / strictly-necessary criteria (see Analytics Cookies Exemption)
• ✅ On the GDPR side, the session identifier is pseudonymised personal data while it can be re-keyed, and legitimate interest is the usual basis — for Sealmetrics as for tools that keep a hashed IP

If minimal cookies (e.g., session cookie):

• "Strictly necessary" exception may apply (if truly needed for service)
• Or analytics exemption under the AEPD framework (AEPD cookies guide; see Analytics Cookies Exemption)

Cookieless advantage: Nothing is stored on the device; where browser properties are read, the analysis moves to the exemption criteria rather than to consent.

Digital Omnibus Future Framework

Article 88a(3)(c) (when in force):

"Creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use"

Explicit consent exemption for:

• Aggregated measurement
• By controller
• For own use

Cookieless analytics alignment: Perfectly aligned with Article 88a(3)(c)

Learn more: EU Digital Omnibus - Cookie Consent Reform

Practical Implementation: GDPR-Compliant Cookieless Analytics

Step 1: Choose Cookieless Solution

Options:

Sealmetrics:

• Cookieless by design
• Aggregated measurement
• First-party data only
• Designed to meet these criteria out of the box, with no configuration needed (our self-assessment)

Server-side analytics:

• Parse server logs
• Anonymize IPs
• Aggregate metrics
• No client-side tracking

Privacy-focused platforms:

• Plausible (cookieless mode)
• Fathom Analytics
• Simple Analytics
• Matomo (cookieless configuration)

Step 2: Configure for Privacy

If using Sealmetrics: the default configuration is designed to meet the criteria above (our self-assessment)

If using other tools:

• ✅ Disable cookies
• ✅ Disable user ID tracking
• ✅ Disable cross-site tracking
• ✅ Enable IP anonymization
• ✅ Limit data retention (24 months max recommended)
• ✅ Disable any advertising features
• ✅ Ensure first-party data only

Step 3: Document the Legitimate Interest Assessment

Accountability (Article 5(2)) calls for a short legitimate interest assessment, because the analytics process pseudonymised data under Article 6(1)(f):

1. What is collected:

   • A small set of fields (page, referrer, device category, country from browser timezone, and a session identifier re-keyed daily — see What We Track)
   • Reports are aggregated

2. Why the impact is minimal:

   • No IP address stored, not even hashed
   • No cookie, local storage or other stored identifier on the device
   • No cross-session linking; the session identifier rotates daily and cannot be reconstructed after rotation, not even by Sealmetrics
   • Per-hit log purged after 1 day; reports are aggregated

3. Conclusion: Pseudonymised operational data, processed under legitimate interest (Article 6(1)(f)); the three-part test above is passed.

If you also run identifier-based tools (a cookie-based analytics platform, ad pixels, a tag manager that sets identifiers): those process persistent identifiers and need their own legitimate interest assessment or consent for that processing. Document them separately.

Retain this record: For accountability (Article 5(2))

Step 4: Update Privacy Policy

Required disclosures:

## Website Analytics

We use cookieless analytics to understand how visitors use our website. This helps us improve content and user experience.

### What We Measure
- Pages visited
- Referrer (where you came from)
- Device type and browser
- Geographic location (country/region)
- Time spent on pages

### What We Don't Do
- We do not use cookies to track you
- We do not track you across websites
- We do not build individual user profiles
- We do not sell or share your data
- We do not use your data for advertising

### Legal Basis
Our website analytics store nothing on your device and no data that identifies you. No IP address is stored and no cookie is set. A session identifier is used in pseudonymised form: it rotates daily and, once rotated, cannot be reconstructed, not even by our provider. We process this pseudonymised data on the basis of our legitimate interest in understanding how our website is used (GDPR Article 6(1)(f)). Per-hit data is kept for 1 day; reports are aggregated.

### Your Rights
You have the rights of access, rectification, erasure, restriction and objection under the GDPR. Because the session identifier rotates daily and cannot be reconstructed, in practice we cannot match a request to the analytics records (GDPR Article 11). You keep every right over any other personal data we process (for example an account or a support request).

For any question, contact: [privacy@example.com]

### Data Retention
Per-hit analytics data is deleted after 1 day. Aggregated reports, which do not identify anyone, are kept for [period].

### Analytics Provider
We use [Sealmetrics/other provider], which acts as our data processor and does not use data for their own purposes.

Step 5: Opt-Out Mechanism (Where One Is Needed)

The right to object (Article 21) applies to processing under legitimate interest, so give visitors a way to exercise it. Because the identifier is unrecoverable after the daily rotation, the practical route is forward-looking: not loading the tracker for that visitor.

Technical opt-out:

• Respect Do Not Track or Global Privacy Control. Sealmetrics does not read either signal, so honouring them means not loading the tracker when they are present — see GPC and DNT signals
• Provide a page where visitors can object; your site then stops loading the tracker for them (implemented by the site — Sealmetrics has no opt-out API)

Best practice: Make it easy; few users will actually opt out of non-invasive cookieless analytics.

Step 6: Maintain Records

Article 30 GDPR: Record of processing activities

Required information:

• Name and contact details of controller
• Purposes of processing (website analytics)
• Categories of data subjects (website visitors)
• Categories of data (pseudonymised session identifier re-keyed daily and unrecoverable after rotation; no IP stored, no persistent identifier; for hashed-IP tools, list the hashed IP)
• Legal basis (legitimate interest, Article 6(1)(f))
• Categories of recipients (analytics provider, if any)
• Retention periods (Sealmetrics: per-hit log 1 day, aggregated reports per your plan)
• Security measures

Maintain this record: Available for supervisory authority if requested.

Common Questions

Do I need a cookie banner for cookieless analytics?

Not necessarily. If nothing is stored on or read from the device, the ePrivacy consent requirement does not apply. If the script reads browser properties (as Sealmetrics does to compute its session identifier), Article 5(3) is engaged and the exemption depends on the audience-measurement criteria — see Analytics Cookies Exemption. For Sealmetrics' own analytics our self-assessment is that no banner is needed; in Germany that is an open question, because the DSK does not extend §25(2) TDDDG to audience measurement — see Germany.

On the GDPR side, a cookieless tool that stores no IP and no persistent identifier still processes minimal pseudonymised data (Sealmetrics: a session identifier that rotates daily and is unrecoverable after rotation). It relies on legitimate interest (Article 6(1)(f)), not consent.

Can I use cookieless Google Analytics?

Google Analytics 4 has a "cookieless mode" but:

• Data still transferred to Google
• Google may use data for its purposes
• May not qualify for GDPR legitimate interest
• May still require consent

Recommendation: Use purpose-built cookieless analytics (Sealmetrics, Plausible, Fathom) for genuine compliance.

Is IP address personal data?

Yes, under GDPR (confirmed by the CJEU in Breyer, C‑582/14).

Tools that store a hashed IP therefore still process personal data and need an Article 6 basis — usually legitimate interest, subject to the assessment above, with limited purpose, limited retention and pseudonymization.

Sealmetrics: never stores the IP, hashed or otherwise. The only touch is a transient in-memory check for bot and abuse filtering, which Recital 49 covers as security processing and which never reaches the analytics data (see How Sealmetrics Blocks Bot Traffic).

What about device fingerprinting?

Device fingerprinting = Combining browser/device characteristics to create a persistent unique identifier for tracking users across sessions.

GDPR status: Persistent device fingerprinting creates personal data and requires legal basis (typically consent).

ePrivacy status: Accessing device information to build persistent identifiers may require consent under Article 5(3).

Sealmetrics: The tracker computes, in the browser, a hash of standard device characteristics (a device fingerprint) to tell a second pageview from a new entrance. It is never written to the device and never stored as sent: the server re-keys it with a daily salt that is destroyed on rotation, so the stored identifier changes every day and cannot link a device across days or sessions. See What We Track.

How long can I retain cookieless analytics data?

GDPR Storage Limitation (Article 5(1)(e)): No longer than necessary

Best practice:

• Raw data (IP addresses, logs): 24 months maximum (aligns with AEPD)
• Aggregated statistics: Indefinitely (non-identifying)

Recommended approach:

1. Collect raw data
2. Aggregate into statistics daily/weekly/monthly
3. Delete raw data after aggregation (or after 24 months max)
4. Retain aggregated reports indefinitely

Can I share cookieless analytics data?

With data processor (Article 28): Yes, if:

• Data Processing Agreement in place
• Processor only acts on your instructions
• Processor does not use data for own purposes

With third parties for their purposes: No, unless:

• Data is truly anonymous (aggregated to point of non-identification)
• OR you obtain consent
• OR another Article 6 basis applies

Best practice: Keep analytics data in-house; only share truly anonymous statistics.

Cookieless Analytics and Data Transfers

GDPR Chapter V: International Transfers

If analytics data transferred outside EU/EEA:

GDPR requirements:

• Adequacy decision, OR
• Appropriate safeguards (Standard Contractual Clauses, Binding Corporate Rules), OR
• Derogations (consent, contract, etc.)

Cookieless advantage:

• Less data to transfer (no user profiles)
• Can keep data in EU more easily (self-hosted or EU providers)

Sealmetrics: customer analytics data stays in the EU (Dublin), so Chapter V transfer rules are not engaged for it.

US-based analytics: Proceed with caution post-Schrems II; ensure SCCs and supplementary measures.

Comparison: Cookie-Based vs. Cookieless

Aspect	Cookie-Based Analytics	Cookieless Analytics
GDPR legal basis	Consent (usually) or contested legitimate interest	Legitimate interest (Article 6(1)(f)) for minimal, pseudonymised data
ePrivacy requirement	Consent required	Not applicable (no cookies)
Cookie banner	Required	Not required where the exemption criteria are met
Data subject rights	Complex (years of profiles)	Simple (minimal data)
Consent rate	50-80% (data loss)	N/A (no consent needed)
Privacy impact	High (tracking over time)	Low (session-only)
User experience	Interrupted (banner)	Seamless (no banner)
Compliance complexity	High	Low
Cost	High (CMP, legal review)	Low (no CMP needed)
Data quality	Skewed (consent bias)	Not reduced by consent rejection

Clear winner: Cookieless analytics for privacy, compliance, UX, and data quality.

Primary sources

• GDPR (Regulation 2016/679) — Art. 4(1) defines personal data; Recital 26 excludes anonymous data — eur-lex
• ePrivacy Directive 2002/58/EC — Art. 5(3): consent to store or access terminal-equipment data — eur-lex
• EDPB Guidelines 2/2023 — technical scope of Art. 5(3): what counts as storage or access — edpb.europa.eu
• Art. 29 WP Opinion 04/2012 (WP194) — cookie consent exemption, including first-party analytics — ec.europa.eu
• CNIL — audience-measurement exemption criteria for consent-free analytics — cnil.fr
• AEPD — Guía sobre el uso de las cookies, analytics-cookie exemption conditions — aepd.es

Related Resources

• Analytics Cookies Exemption Requirements - AEPD and EU DPA guidance on analytics without consent
• EU Digital Omnibus - Cookie Consent Reform - Future framework for analytics under Article 88a
• EU Digital Omnibus - Impact on Analytics - How regulations affect analytics industry
• Is Sealmetrics GDPR, ePrivacy, CCPA, and PECR Compliant? - How the isolated-hit model applies these principles
• Do Temporary Session Identifiers (Session IDs) Require Consent Under GDPR? - When session identifiers stay consent-exempt
• Why Sealmetrics Can Measure Without Consent - The technical basis for consentless measurement

Key Takeaways

1. Cookieless analytics can comply with GDPR without consent banners
2. Legitimate interest (Article 6(1)(f)) fits minimal, pseudonymised data — Sealmetrics relies on it for its daily-rotating session identifier, which is unrecoverable after rotation; no consent under GDPR
3. ePrivacy consent not required when nothing is stored on or read from the device; where browser properties are read, the audience-measurement exemption criteria decide
4. Data minimization by design: Cookieless naturally satisfies GDPR principles
5. Simpler data subject rights: Minimal data = minimal rights management
6. No cookie banner needed where the exemption criteria are met (in Germany an open question): Better UX, complete data, lower costs
7. Future-proof: Aligns with Digital Omnibus Article 88a(3)(c)
8. Document the legitimate interest assessment: Short for a minimal cookieless tool; keep separate ones for identifier-based tools you also run
9. Privacy policy disclosure: Required even for cookieless analytics
10. Right to object: Applies under legitimate interest; with an unrecoverable identifier, honour it going forward by not loading the tracker

Cookieless analytics represent the evolution of privacy-respecting measurement. By eliminating persistent tracking while maintaining statistical accuracy, they satisfy both GDPR requirements and user expectations for privacy. As the Digital Omnibus makes clear, aggregated audience measurement for own use is not invasive surveillance—it's legitimate business intelligence. Cookieless analytics embody this principle in practice.