Skip to main content

GDPR and Cookieless Analytics

Important Notice

Any statement here about how Sealmetrics meets a criterion is a self-assessment, not a certification. No supervisory authority certifies or validates analytics tools, and Sealmetrics holds no third-party security certification (no ISO 27001, no SOC 2). This page is general regulatory analysis, not legal advice.

Cookieless analytics represent a fundamental shift in how websites measure traffic while complying with GDPR. By eliminating persistent user identifiers, cookieless solutions can provide comprehensive analytics without consent banners, data loss, or privacy violations.

The GDPR Challenge for Traditional Analytics​

Why Cookies Trigger GDPR​

Cookies = Personal Data (in most cases):

When a cookie contains a unique identifier that can be linked to an individual—even indirectly—it constitutes personal data under GDPR Article 4(1):

"Personal data means any information relating to an identified or identifiable natural person"

Traditional analytics cookies:

  • Unique visitor IDs
  • Session identifiers
  • Tracking across visits
  • Building behavioral profiles over time

Result: Processing personal data requires lawful basis under GDPR Article 6.

Common (Problematic) Approaches​

Approach 1: Consent (Article 6(1)(a))​

Implementation: Cookie banner requesting consent for analytics

Problems:

  • 20-30% of users reject cookies
  • Data loss from non-consenting users
  • Skewed analytics (privacy-conscious users underrepresented)
  • Consent fatigue
  • Complex consent management
  • Cost of consent management platforms

Compliance challenge: Consent must be "freely given, specific, informed, and unambiguous" (GDPR Article 4(11); see EDPB Guidelines 05/2020 on consent)—difficult with cookie walls or dark patterns.

Approach 2: Legitimate Interest (Article 6(1)(f))​

Claim: Analytics is a legitimate interest

Problems:

  • Must pass three-part test:
    1. Legitimate interest exists ✅ (understanding website performance)
    2. Processing is necessary ❓ (are cookies necessary for analytics?)
    3. Balancing test ❓ (interests vs. rights)
  • Data protection authorities skeptical of legitimate interest for tracking cookies
  • Right to object must be provided
  • EDPB guidance suggests consent is safer route for most cookies

Risk: Supervisory authority or court may reject legitimate interest claim for tracking cookies.

Approach 3: Ignore GDPR (Non-Compliance)​

Implementation: Place analytics cookies without legal basis

Consequences:

  • GDPR violations
  • Fines up to €20M or 4% global revenue
  • Enforcement actions
  • Reputational damage
  • User complaints

Not recommended: High-profile Google Analytics enforcement (Austria, France, Italy) demonstrates authorities are serious.

The Cookieless Solution​

What is Cookieless Analytics?​

Definition: Web analytics that do not use cookies or similar persistent identifiers to track users across sessions.

Technical approaches:

  1. Session-based measurement: Track page views within session, without cross-session linking
  2. Server-side logging: Analyze server logs without client-side identifiers
  3. Cookieless session identification: Without personal data or persistent identifiers
  4. Aggregated metrics only: Count events without identifying individuals

Key principle: Measure the audience (how many, from where, what they do) without tracking individuals (who specifically, what they do over time).

Why Cookieless Complies with GDPR​

1. No Personal Data Processing (Ideal Case)​

If truly anonymous:

  • No unique identifiers
  • No linking across sessions
  • No individual tracking
  • GDPR does not apply (Recital 26: anonymous information not covered)

Example: Server logs counting page views per hour, by country, without any visitor identification.

Advantage: No legal basis required; GDPR inapplicable to anonymous data.

This is Sealmetrics' position. The stored dataset holds four non-identifying variables, no IP address (not even hashed) and no identifier of any kind, so it falls outside the material scope of the GDPR under Recital 26. The Article 6 question — consent or legitimate interest — never arises for visitor analytics. Sealmetrics does not rely on legitimate interest for it; it does not need to.

2. Minimal Personal Data (Other Cookieless Tools)​

Some cookieless tools still process personal data — typically a hashed IP address, which remains personal data. For those tools an Article 6 basis is required, and the one they generally rely on is legitimate interest:

Legitimate interest (Article 6(1)(f)) is a stronger case for such tools than for cookie-based tracking:

Necessity test:

  • Cookieless measurement is genuinely necessary (no less intrusive alternative exists for basic traffic measurement)
  • Purpose is limited and clear

Balancing test:

  • Low privacy impact (no profiling, no cross-site tracking, no long-term identifiers)
  • User expectations: Reasonable to expect website measures traffic
  • Transparency: Easy to explain and understand
  • No high risk to data subjects

Outcome: Legitimate interest is likely valid for a cookieless tool that retains a hashed IP, where it may not be for cookie-based tracking. It is still a weaker position than case 1, because it concedes that personal data is processed.

Where GDPR Article 6 Fits​

Article 6 lists the lawful bases for processing personal data. It is only reached if personal data is processed. For a dataset with no IP and no identifier (case 1 above, Sealmetrics), it is not reached at all. The table below shows how each basis fares for cookieless tools that do still process some personal data (case 2):

Legal BasisApplicabilityRequirements
Consent (6(1)(a))Not needed for cookielessN/A - no tracking to consent to
Contract (6(1)(b))Rarely applicableAnalytics not necessary for service delivery
Legal obligation (6(1)(c))Not applicableNo law requires website analytics
Vital interests (6(1)(d))Not applicableAnalytics don't protect life
Public task (6(1)(e))Public sector onlyGovernment websites measuring performance
Legitimate interest (6(1)(f))Usual basis for tools that keep a hashed IP or other identifierWebsite operator's interest in understanding traffic, documented in a legitimate interest assessment

For Sealmetrics: none of the above is required. No personal data is processed, so Recital 26 places the visitor analytics dataset outside the Regulation.

For tools that retain a hashed IP: legitimate interest (Article 6(1)(f)) is the basis most rely on, and it has to be documented in the assessment below.

Legitimate Interest Assessment: When It Is Required​

Not required for Sealmetrics visitor analytics. A legitimate interest assessment (the three-part test) is the accountability record for processing that relies on Article 6(1)(f). Where no personal data is processed there is no Article 6 processing to assess, so no assessment is needed. The document to keep instead is a short record of why the dataset contains no personal data: no IP stored, no cookie or identifier, no cross-session linking, four non-identifying variables.

Still required for identifier-based tools you also run. Publishers who operate a cookie-based or hashed-IP tool alongside Sealmetrics (a tag manager, an ad pixel, a second analytics platform) still need the assessment for that processing. The test is kept here for that purpose.

Three-Part Test (for identifier-based tools)​

Part 1: Legitimate Interest​

Question: Does the controller have a legitimate interest?

For a minimal analytics tool that still processes personal data (e.g., a hashed IP):

  • ✅ Understanding website performance
  • ✅ Improving user experience
  • ✅ Optimizing content
  • ✅ Technical operations and security
  • ✅ Business planning and development

GDPR Recital 47: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

By analogy: If direct marketing is legitimate interest, certainly understanding website usage is too.

Conclusion: Legitimate interest clearly exists.

Part 2: Necessity​

Question: Is processing necessary for that interest?

For a minimal analytics tool that still processes personal data:

  • ✅ Cannot understand traffic without measurement
  • ✅ Cookieless approach is far less intrusive than cookie-based tracking
  • ⚠️ A less invasive alternative does exist: a tool that stores no IP and no identifier at all (case 1 above), which moves the processing outside the GDPR entirely

Article 5(1)(c): Data minimization—collect only what is necessary

A minimal cookieless tool demonstrates data minimization:

  • No persistent identifiers
  • No cross-session tracking
  • Aggregated measurement
  • Short data retention

Conclusion: Processing is necessary, and minimized to what's required.

Part 3: Balancing Test​

Question: Do data subject interests, rights, and freedoms override the legitimate interest?

Factors to consider:

Nature of data:

  • Basic traffic metrics (not sensitive)
  • No special categories (Article 9)
  • Minimal personal data (e.g., a hashed IP)

Reasonable expectations:

  • Users expect websites measure traffic
  • Cookieless is less invasive than expected (no tracking)
  • Transparent and understandable

Impact on data subjects:

  • Low risk: No profiling, no behavioral advertising, no selling data
  • No discrimination: Analytics not used for automated decisions affecting individuals
  • No vulnerability: Not targeting children or vulnerable populations

Safeguards:

  • Privacy policy disclosure
  • Right to object provided
  • Data security measures
  • Limited retention periods

Conclusion: For a minimal, non-profiling tool, interests do NOT override; legitimate interest is valid. Cookie-based profiling tools rarely get this far.

FactorCookieless Analytics (no IP, no identifier)Cookie-Based Tracking
Personal data processedNone (Recital 26) ✅Yes (unique identifiers) ❌
Article 6 basis neededNo — Article 6 is not reached ✅Yes — consent, or a contested legitimate interest claim ❓
Legitimate interest assessmentNot required ✅Required if relying on 6(1)(f) ⚠️
Privacy impactLow (no tracking) ✅High (persistent tracking) ❌
User expectationsReasonable ✅Negative (tracking) ❌
SafeguardsBuilt-in (no IDs) ✅Requires controls ⚠️

Result: A no-personal-data cookieless dataset needs no Article 6 basis at all. Cookie-based tracking needs one, and legitimate interest is questionable for it — consent is the safer route.

GDPR Principles and Cookieless Analytics​

Principle 1: Lawfulness, Fairness, Transparency (Article 5(1)(a))​

Lawfulness: No personal data is processed, so no Article 6 legal basis is required (Recital 26) ✅

Fairness:

  • Users not deceived
  • No hidden tracking
  • Processing aligns with reasonable expectations ✅

Transparency:

  • Privacy policy discloses analytics
  • Clear explanation of what's measured
  • How to exercise rights ✅

Cookieless advantage: Easier to explain ("we count visitors, we don't track you") vs. complex cookie ecosystems.

Principle 2: Purpose Limitation (Article 5(1)(b))​

Requirement: Data collected for specified, explicit, legitimate purposes; not further processed incompatibly

Cookieless analytics:

  • ✅ Clear purpose: Website performance measurement
  • ✅ Limited scope: Traffic statistics for website operator's use
  • ✅ No secondary uses: Not sold, not used for advertising, not shared

Compliance: Purpose limitation naturally satisfied by design.

Principle 3: Data Minimization (Article 5(1)(c))​

Requirement: Adequate, relevant, and limited to what is necessary

Cookieless analytics:

  • ✅ No persistent user IDs (eliminates unnecessary tracking)
  • ✅ Aggregated metrics (only what's needed for statistics)
  • ✅ No individual profiles (unnecessary for traffic measurement)
  • ✅ No personal data in the stored dataset (no IP stored, no identifier, no cross-session linking)

Gold standard: Cookieless is data minimization by design.

Principle 4: Accuracy (Article 5(1)(d))​

Requirement: Personal data must be accurate and kept up to date

Cookieless analytics:

  • ✅ Aggregate statistics (accuracy inherent in counting)
  • ✅ No individual data to be inaccurate
  • ✅ Session-based measurement (no stale profiles)

Benefit: Less risk of inaccuracy when not maintaining user profiles.

Principle 5: Storage Limitation (Article 5(1)(e))​

Requirement: Kept in identifiable form no longer than necessary

Cookieless analytics:

  • ✅ Session-only tracking (no long-term storage of identifiers)
  • ✅ Aggregated data quickly (raw logs not retained long)
  • ✅ Typical retention: 24 months maximum (align with AEPD requirements)
  • ✅ Aggregated reports can be kept indefinitely (no personal data)

Best practice: Delete raw server logs after aggregation; retain only statistics.

Principle 6: Integrity and Confidentiality (Article 5(1)(f))​

Requirement: Appropriate security measures

Cookieless analytics:

  • ✅ Less data to secure (no long-term user profiles)
  • ✅ Encryption in transit (HTTPS)
  • ✅ Access controls
  • ✅ Secure infrastructure

Reduced risk: Less valuable to attackers (no persistent user data to breach).

Principle 7: Accountability (Article 5(2))​

Requirement: Controller must demonstrate compliance

Cookieless analytics:

  • ✅ Document why no personal data is processed (the Recital 26 record); a legitimate interest assessment is only needed for identifier-based tools you also run
  • ✅ Maintain records of processing activities (Article 30)
  • ✅ Privacy policy reflects cookieless approach
  • ✅ Data protection by design (Article 25)

Demonstration: Easier to show compliance when processing is minimal.

Data Subject Rights and Cookieless Analytics​

Right of Access (Article 15)​

User request: "What personal data do you have about me?"

Cookieless analytics response:

  • If truly anonymous: "Our analytics do not process your personal data; we cannot identify you in our statistics."
  • If minimal data (IP in logs): "We have server logs with your IP address from [date/time], used for traffic measurement. This data will be deleted after [retention period]."

Advantage: Simple response; no extensive user profiles to provide.

Right to Rectification (Article 16)​

User request: "Correct inaccurate data about me"

Cookieless analytics:

  • Not applicable (no individual user profiles to be inaccurate)
  • Aggregate statistics are accurate by design

Right to Erasure (Article 17)​

User request: "Delete my data"

Cookieless analytics:

  • If anonymous: Not possible (cannot identify user in aggregate data)
  • If IP in logs: Can delete specific IP entries, or explain scheduled deletion period

Practical: Much easier than cookie-based systems tracking users across months/years.

Right to Restriction (Article 18)​

User request: "Stop processing my data while we resolve a dispute"

Cookieless analytics:

  • Rarely applicable (no ongoing individual processing to restrict)
  • Can flag IP for non-processing if requested

Right to Data Portability (Article 20)​

User request: "Give me my data in portable format"

Cookieless analytics:

  • Not applicable (Article 20 requires processing based on consent or contract; a no-personal-data dataset relies on neither)
  • Even if applied: No meaningful individual data to port (aggregate statistics not "personal data")

Right to Object (Article 21)​

User request: "Stop processing my data for analytics"

Article 21 applies to processing based on Article 6(1)(e) or (f). Where no personal data is processed, there is no Article 6 processing to object to and no visitor to single out — the right is not engaged.

Cookieless analytics response:

  • If truly anonymous (Sealmetrics): "Our analytics hold no personal data about you, so there is nothing to object to; no record of you exists to be excluded."
  • If minimal data (hashed IP): The right applies. Provide a mechanism (e.g., email address in privacy policy) and honor objections.

Implementation options for tools where the right applies:

  1. IP exclusion: Add user's IP to exclusion list (imperfect, dynamic IPs)
  2. Browser signal: Respect Do Not Track or Global Privacy Control
  3. Opt-out cookie: Paradoxically, set cookie to exclude from cookieless analytics
  4. Manual request: User contacts, we exclude their IP or sessions

Best practice: Make objection easy and effective where it applies.

Cookieless Analytics and ePrivacy​

ePrivacy Directive Article 5(3)​

Separate from GDPR: Article 5(3) of Directive 2002/58/EC regulates terminal equipment access (cookies, device fingerprinting)

Requirement: Consent for storing/accessing information in terminal equipment

Exception: Strictly necessary for service delivery

Cookieless and ePrivacy Compliance​

Key question: Do cookieless analytics access/store information in terminal equipment?

If NO cookies or client-side storage:

  • ✅ ePrivacy Directive does not apply
  • ✅ No consent required under ePrivacy
  • ✅ GDPR is not engaged either when the stored dataset holds no personal data (Recital 26); for tools that keep a hashed IP, GDPR applies and legitimate interest is the usual basis

If minimal cookies (e.g., session cookie):

Cookieless advantage: Bypasses ePrivacy consent requirement entirely.

Digital Omnibus Future Framework​

Article 88a(3)(c) (when in force):

"Creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use"

Explicit consent exemption for:

  • Aggregated measurement
  • By controller
  • For own use

Cookieless analytics alignment: Perfectly aligned with Article 88a(3)(c)

Learn more: EU Digital Omnibus - Cookie Consent Reform

Practical Implementation: GDPR-Compliant Cookieless Analytics​

Step 1: Choose Cookieless Solution​

Options:

Sealmetrics:

  • Cookieless by design
  • Aggregated measurement
  • First-party data only
  • Meets these criteria out of the box, with no configuration needed

Server-side analytics:

  • Parse server logs
  • Anonymize IPs
  • Aggregate metrics
  • No client-side tracking

Privacy-focused platforms:

  • Plausible (cookieless mode)
  • Fathom Analytics
  • Simple Analytics
  • Matomo (cookieless configuration)

Step 2: Configure for Privacy​

If using Sealmetrics: the default configuration already meets the criteria above

If using other tools:

  • ✅ Disable cookies
  • ✅ Disable user ID tracking
  • ✅ Disable cross-site tracking
  • ✅ Enable IP anonymization
  • ✅ Limit data retention (24 months max recommended)
  • ✅ Disable any advertising features
  • ✅ Ensure first-party data only

Step 3: Document Why No Personal Data Is Processed​

No legitimate interest assessment is required for a tool that processes no personal data: the three-part test exists to justify Article 6(1)(f) processing, and there is none. What accountability (Article 5(2)) calls for instead is a short record showing why the dataset sits outside the GDPR:

  1. What is collected:

    • Four non-identifying variables (page, referrer, device category, country from browser timezone)
    • Aggregated traffic statistics only

  2. Why it is not personal data (Recital 26):

    • No IP address stored, not even hashed
    • No cookie, local storage or other identifier
    • No cross-session linking; no visitor can be singled out
    • Nothing written to or read from the device

  3. Conclusion: No personal data is processed, so no Article 6 basis (consent or legitimate interest) is needed.

If you also run identifier-based tools (a cookie-based analytics platform, ad pixels, a tag manager that sets identifiers): those do process personal data and still need a legitimate interest assessment or consent for that processing. Document them separately.

Retain this record: For accountability (Article 5(2))

Step 4: Update Privacy Policy​

Required disclosures:

## Website Analytics

We use cookieless analytics to understand how visitors use our website. This helps us improve content and user experience.

### What We Measure
- Pages visited
- Referrer (where you came from)
- Device type and browser
- Geographic location (country/region)
- Time spent on pages

### What We Don't Do
- We do not use cookies to track you
- We do not track you across websites
- We do not build individual user profiles
- We do not sell or share your data
- We do not use your data for advertising

### Legal Basis
Our website analytics do not process personal data. No IP address is stored, no cookie or identifier is set, and no visitor can be singled out. Under GDPR Recital 26 this information is anonymous and falls outside the Regulation, so no legal basis under Article 6 (consent or legitimate interest) is required for it.

### Your Rights
Because our analytics hold no personal data about you, there is nothing in them to access, correct, delete or object to. You keep every right under the GDPR over any personal data we process elsewhere (for example an account or a support request).

For any question, contact: [privacy@example.com]

### Data Retention
Analytics data is retained for 24 months, then deleted.

### Analytics Provider
We use [Sealmetrics/other provider], which acts as our data processor and does not use data for their own purposes.

Step 5: Opt-Out Mechanism (Where One Is Needed)​

With no personal data processed, no opt-out is legally required — there is no record of the visitor to exclude. Offering one remains a courtesy some publishers choose.

Technical opt-out (courtesy, or required for identifier-based tools you also run):

  • Respect Do Not Track header
  • Respect Global Privacy Control
  • Provide dedicated opt-out page

Best practice: If you offer it, make it easy; few users will actually opt out of non-invasive cookieless analytics.

Step 6: Maintain Records​

Article 30 GDPR: Record of processing activities

Required information:

  • Name and contact details of controller
  • Purposes of processing (website analytics)
  • Categories of data subjects (website visitors)
  • Categories of data (state expressly that no personal data is stored: no IP, no identifier; for hashed-IP tools, list the IP as personal data)
  • Categories of recipients (analytics provider, if any)
  • Retention periods (24 months)
  • Security measures

Maintain this record: Available for supervisory authority if requested.

Common Questions​

No. If analytics are truly cookieless (no cookies, no persistent identifiers), ePrivacy consent requirement does not apply.

GDPR is not engaged either when nothing stored identifies a visitor: no IP (hashed or otherwise), no identifier, no cross-session linking. Under Recital 26 that dataset is anonymous and needs no legal basis — neither consent nor legitimate interest.

Can I use cookieless Google Analytics?​

Google Analytics 4 has a "cookieless mode" but:

  • Data still transferred to Google
  • Google may use data for its purposes
  • May not qualify for GDPR legitimate interest
  • May still require consent

Recommendation: Use purpose-built cookieless analytics (Sealmetrics, Plausible, Fathom) for genuine compliance.

Is IP address personal data?​

Yes, under GDPR (confirmed by the CJEU in Breyer, C‑582/14).

Tools that store a hashed IP therefore still process personal data and need an Article 6 basis — usually legitimate interest, subject to the assessment above, with limited purpose, limited retention and pseudonymization.

Sealmetrics: never stores the IP, hashed or otherwise, so the analytics dataset holds no personal data. The only touch is a transient in-memory check for bot and abuse filtering, which Recital 49 covers as security processing and which never reaches the analytics data (see How Sealmetrics Blocks Bot Traffic).

What about device fingerprinting?​

Device fingerprinting = Combining browser/device characteristics to create a persistent unique identifier for tracking users across sessions.

GDPR status: Persistent device fingerprinting creates personal data and requires legal basis (typically consent).

ePrivacy status: Accessing device information to build persistent identifiers may require consent under Article 5(3).

Sealmetrics: Does not use device fingerprinting. Sessions are identified using cookieless, privacy-preserving technology that does not create persistent identifiers and cannot track users across sessions.

How long can I retain cookieless analytics data?​

GDPR Storage Limitation (Article 5(1)(e)): No longer than necessary

Best practice:

  • Raw data (IP addresses, logs): 24 months maximum (aligns with AEPD)
  • Aggregated statistics: Indefinitely (no personal data)

Recommended approach:

  1. Collect raw data
  2. Aggregate into statistics daily/weekly/monthly
  3. Delete raw data after aggregation (or after 24 months max)
  4. Retain aggregated reports indefinitely

Can I share cookieless analytics data?​

With data processor (Article 28): Yes, if:

  • Data Processing Agreement in place
  • Processor only acts on your instructions
  • Processor does not use data for own purposes

With third parties for their purposes: No, unless:

  • Data is truly anonymous (aggregated to point of non-identification)
  • OR you obtain consent
  • OR another Article 6 basis applies

Best practice: Keep analytics data in-house; only share truly anonymous statistics.

Cookieless Analytics and Data Transfers​

GDPR Chapter V: International Transfers​

If analytics data transferred outside EU/EEA:

GDPR requirements:

  • Adequacy decision, OR
  • Appropriate safeguards (Standard Contractual Clauses, Binding Corporate Rules), OR
  • Derogations (consent, contract, etc.)

Cookieless advantage:

  • Less data to transfer (no user profiles)
  • Can keep data in EU more easily (self-hosted or EU providers)

Sealmetrics: customer analytics data stays in the EU (Dublin), so Chapter V transfer rules are not engaged for it.

US-based analytics: Proceed with caution post-Schrems II; ensure SCCs and supplementary measures.

AspectCookie-Based AnalyticsCookieless Analytics
GDPR legal basisConsent (usually) or contested legitimate interestNone required when no personal data is stored (Recital 26); legitimate interest only for tools that keep a hashed IP
ePrivacy requirementConsent requiredNot applicable (no cookies)
Cookie bannerRequiredNot required
Data subject rightsComplex (years of profiles)Simple (minimal data)
Consent rate50-80% (data loss)N/A (100% data)
Privacy impactHigh (tracking over time)Low (session-only)
User experienceInterrupted (banner)Seamless (no banner)
Compliance complexityHighLow
CostHigh (CMP, legal review)Low (no CMP needed)
Data qualitySkewed (consent bias)Complete (all visitors)

Clear winner: Cookieless analytics for privacy, compliance, UX, and data quality.

Primary sources​

  • GDPR (Regulation 2016/679) — Art. 4(1) defines personal data; Recital 26 excludes anonymous data — eur-lex
  • ePrivacy Directive 2002/58/EC — Art. 5(3): consent to store or access terminal-equipment data — eur-lex
  • EDPB Guidelines 2/2023 — technical scope of Art. 5(3): what counts as storage or access — edpb.europa.eu
  • Art. 29 WP Opinion 04/2012 (WP194) — cookie consent exemption, including first-party analytics — ec.europa.eu
  • CNIL — audience-measurement exemption criteria for consent-free analytics — cnil.fr
  • AEPD — Guía sobre el uso de las cookies, analytics-cookie exemption conditions — aepd.es

Key Takeaways​

  1. Cookieless analytics can comply with GDPR without consent banners
  2. No Article 6 basis is needed when no personal data is processed (Recital 26) — Sealmetrics relies on neither legitimate interest nor consent for visitor analytics
  3. ePrivacy consent not required when no cookies or terminal storage used
  4. Data minimization by design: Cookieless naturally satisfies GDPR principles
  5. Simpler data subject rights: Minimal data = minimal rights management
  6. No cookie banner needed: Better UX, complete data, lower costs
  7. Future-proof: Aligns with Digital Omnibus Article 88a(3)(c)
  8. Document the Recital 26 analysis: Record why no personal data is processed; a legitimate interest assessment is only needed for identifier-based tools you also run
  9. Privacy policy disclosure: Required even for cookieless analytics
  10. Right to object: Arises only where personal data is processed; not engaged for a no-personal-data dataset

Cookieless analytics represent the evolution of privacy-respecting measurement. By eliminating persistent tracking while maintaining statistical accuracy, they satisfy both GDPR requirements and user expectations for privacy. As the Digital Omnibus makes clear, aggregated audience measurement for own use is not invasive surveillance—it's legitimate business intelligence. Cookieless analytics embody this principle in practice.

Written and maintained by the Sealmetrics Team