---
title: "GDPR and Cookieless Analytics"
description: "How cookieless analytics comply with GDPR requirements and provide better data without consent banners"
canonical_url: "https://docs.sealmetrics.com/compliance/gdpr-cookieless-analytics"
lang: "en"
date_generated: "2026-09-21T08:45:24.602Z"
source_hash: "d9d1bcccfd72dec7d5fc8e7fd883c11bbbb2f2e08996e9beff8c96be390718ac"
content_type: "trust-and-legal"
owner: "legal"
llm_priority: "critical"
source_file: "compliance/gdpr-cookieless-analytics.md"
publisher: "Sealmetrics"
---

# GDPR and Cookieless Analytics

Canonical page: https://docs.sealmetrics.com/compliance/gdpr-cookieless-analytics

**Info:**
Any statement here about how Sealmetrics meets a criterion is a **self-assessment**, not a certification. No supervisory authority certifies or validates analytics tools, and Sealmetrics holds no third-party security certification (no ISO 27001, no SOC 2). This page is general regulatory analysis, not legal advice.

Cookieless analytics represent a fundamental shift in how websites measure traffic while complying with GDPR. By eliminating persistent user identifiers, cookieless solutions can provide comprehensive analytics without consent banners, data loss, or privacy violations.

## The GDPR Challenge for Traditional Analytics

### Why Cookies Trigger GDPR

**Cookies = Personal Data** (in most cases):

When a cookie contains a unique identifier that can be linked to an individual—even indirectly—it constitutes **personal data** under GDPR [Article 4(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679):

> "Personal data means any information relating to an identified or identifiable natural person"

**Traditional analytics cookies**:
- Unique visitor IDs
- Session identifiers
- Tracking across visits
- Building behavioral profiles over time

**Result**: Processing personal data requires lawful basis under **GDPR Article 6**.

### Common (Problematic) Approaches

#### Approach 1: Consent (Article 6(1)(a))

**Implementation**: Cookie banner requesting consent for analytics

**Problems**:
- 20-30% of users reject cookies
- Data loss from non-consenting users
- Skewed analytics (privacy-conscious users underrepresented)
- Consent fatigue
- Complex consent management
- Cost of consent management platforms

**Compliance challenge**: Consent must be "freely given, specific, informed, and unambiguous" (GDPR [Article 4(11)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679); see [EDPB Guidelines 05/2020 on consent](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en))—difficult with cookie walls or dark patterns.

#### Approach 2: Legitimate Interest (Article 6(1)(f))

**Claim**: Analytics is a legitimate interest

**Problems**:
- Must pass three-part test:
  1. Legitimate interest exists ✅ (understanding website performance)
  2. Processing is necessary ❓ (are cookies necessary for analytics?)
  3. Balancing test ❓ (interests vs. rights)
- Data protection authorities skeptical of legitimate interest for tracking cookies
- Right to object must be provided
- EDPB guidance suggests consent is safer route for most cookies

**Risk**: Supervisory authority or court may reject legitimate interest claim for tracking cookies.

#### Approach 3: Ignore GDPR (Non-Compliance)

**Implementation**: Place analytics cookies without legal basis

**Consequences**:
- GDPR violations
- Fines up to €20M or 4% global revenue
- Enforcement actions
- Reputational damage
- User complaints

**Not recommended**: High-profile Google Analytics enforcement (Austria, France, Italy) demonstrates authorities are serious.

## The Cookieless Solution

### What is Cookieless Analytics?

**Definition**: Web analytics that do not use cookies or similar persistent identifiers to track users across sessions.

**Technical approaches**:
1. **Session-based measurement**: Track page views within session, without cross-session linking
2. **Server-side logging**: Analyze server logs without client-side identifiers
3. **Cookieless session identification**: Without personal data or persistent identifiers
4. **Aggregated metrics only**: Count events without identifying individuals

**Key principle**: Measure the **audience** (how many, from where, what they do) without **tracking individuals** (who specifically, what they do over time).

### Why Cookieless Complies with GDPR

#### 1. No Personal Data Processing (Ideal Case)

**If truly anonymous**:
- No unique identifiers
- No linking across sessions
- No individual tracking
- GDPR does not apply ([Recital 26](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679): anonymous information not covered)

**Example**: Server logs counting page views per hour, by country, without any visitor identification.

**Advantage**: No legal basis required; GDPR inapplicable to anonymous data.

**This is Sealmetrics' position.** The stored dataset holds a small set of non-identifying fields ([listed here](/security-privacy/what-we-track)), no IP address (not even hashed) and no persistent identifier — the only per-visitor value is a daily session pseudonym, re-keyed with a salt that is destroyed every day and purged from the per-hit log after 1 day — so in Sealmetrics' assessment it falls outside the material scope of the GDPR under Recital 26. The Article 6 question — consent or legitimate interest — never arises for visitor analytics. Sealmetrics does not rely on legitimate interest for it; it does not need to.

#### 2. Minimal Personal Data (Other Cookieless Tools)

**Some cookieless tools still process personal data** — typically a hashed IP address, which remains personal data. For those tools an Article 6 basis is required, and the one they generally rely on is legitimate interest:

**Legitimate interest (Article 6(1)(f)) is a stronger case** for such tools than for cookie-based tracking:

**Necessity test**:
- Cookieless measurement is **genuinely necessary** (no less intrusive alternative exists for basic traffic measurement)
- Purpose is limited and clear

**Balancing test**:
- Low privacy impact (no profiling, no cross-site tracking, no long-term identifiers)
- User expectations: Reasonable to expect website measures traffic
- Transparency: Easy to explain and understand
- No high risk to data subjects

**Outcome**: Legitimate interest is likely valid for a cookieless tool that retains a hashed IP, where it may not be for cookie-based tracking. It is still a weaker position than case 1, because it concedes that personal data is processed.

### Where GDPR Article 6 Fits

**Article 6 lists the lawful bases for processing personal data. It is only reached if personal data is processed.** For a dataset with no IP and no identifier (case 1 above, Sealmetrics), it is not reached at all. The table below shows how each basis fares for cookieless tools that *do* still process some personal data (case 2):

| Legal Basis | Applicability | Requirements |
|-------------|---------------|--------------|
| **Consent (6(1)(a))** | Not needed for cookieless | N/A - no tracking to consent to |
| **Contract (6(1)(b))** | Rarely applicable | Analytics not necessary for service delivery |
| **Legal obligation (6(1)(c))** | Not applicable | No law requires website analytics |
| **Vital interests (6(1)(d))** | Not applicable | Analytics don't protect life |
| **Public task (6(1)(e))** | Public sector only | Government websites measuring performance |
| **Legitimate interest (6(1)(f))** | Usual basis for tools that keep a hashed IP or other identifier | Website operator's interest in understanding traffic, documented in a legitimate interest assessment |

**For Sealmetrics**: none of the above is required. No personal data is processed, so Recital 26 places the visitor analytics dataset outside the Regulation.

**For tools that retain a hashed IP**: legitimate interest (Article 6(1)(f)) is the basis most rely on, and it has to be documented in the assessment below.

## Legitimate Interest Assessment: When It Is Required

**Not required for Sealmetrics visitor analytics.** A legitimate interest assessment (the three-part test) is the accountability record for processing that relies on Article 6(1)(f). Where no personal data is processed there is no Article 6 processing to assess, so no assessment is needed. The document to keep instead is a short record of *why* the dataset contains no personal data: no IP stored, no cookie, no persistent identifier (only a daily-re-keyed session pseudonym, purged after 1 day), no cross-session linking, a small set of non-identifying fields.

**Still required for identifier-based tools you also run.** Publishers who operate a cookie-based or hashed-IP tool alongside Sealmetrics (a tag manager, an ad pixel, a second analytics platform) still need the assessment for *that* processing. The test is kept here for that purpose.

### Three-Part Test (for identifier-based tools)

#### Part 1: Legitimate Interest

**Question**: Does the controller have a legitimate interest?

**For a minimal analytics tool that still processes personal data** (e.g., a hashed IP):
- ✅ Understanding website performance
- ✅ Improving user experience
- ✅ Optimizing content
- ✅ Technical operations and security
- ✅ Business planning and development

**GDPR Recital 47**: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

**By analogy**: If direct marketing is legitimate interest, certainly understanding website usage is too.

**Conclusion**: Legitimate interest clearly exists.

#### Part 2: Necessity

**Question**: Is processing necessary for that interest?

**For a minimal analytics tool that still processes personal data**:
- ✅ Cannot understand traffic without measurement
- ✅ Cookieless approach is far less intrusive than cookie-based tracking
- ⚠️ A less invasive alternative does exist: a tool that stores no IP and no identifier at all (case 1 above), which moves the processing outside the GDPR entirely

**[Article 5(1)(c)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)**: Data minimization—collect only what is necessary

**A minimal cookieless tool demonstrates data minimization**:
- No persistent identifiers
- No cross-session tracking
- Aggregated measurement
- Short data retention

**Conclusion**: Processing is necessary, and minimized to what's required.

#### Part 3: Balancing Test

**Question**: Do data subject interests, rights, and freedoms override the legitimate interest?

**Factors to consider**:

**Nature of data**:
- Basic traffic metrics (not sensitive)
- No special categories (Article 9)
- Minimal personal data (e.g., a hashed IP)

**Reasonable expectations**:
- Users expect websites measure traffic
- Cookieless is less invasive than expected (no tracking)
- Transparent and understandable

**Impact on data subjects**:
- **Low risk**: No profiling, no behavioral advertising, no selling data
- **No discrimination**: Analytics not used for automated decisions affecting individuals
- **No vulnerability**: Not targeting children or vulnerable populations

**Safeguards**:
- Privacy policy disclosure
- Right to object provided
- Data security measures
- Limited retention periods

**Conclusion**: For a minimal, non-profiling tool, interests do NOT override; legitimate interest is valid. Cookie-based profiling tools rarely get this far.

### Legal Position: Cookieless vs. Cookie-Based

| Factor | Cookieless Analytics (no IP, no identifier) | Cookie-Based Tracking |
|--------|----------------------|----------------------|
| **Personal data processed** | None (Recital 26) ✅ | Yes (unique identifiers) ❌ |
| **Article 6 basis needed** | No — Article 6 is not reached ✅ | Yes — consent, or a contested legitimate interest claim ❓ |
| **Legitimate interest assessment** | Not required ✅ | Required if relying on 6(1)(f) ⚠️ |
| **Privacy impact** | Low (no tracking) ✅ | High (persistent tracking) ❌ |
| **User expectations** | Reasonable ✅ | Negative (tracking) ❌ |
| **Safeguards** | Built-in (no IDs) ✅ | Requires controls ⚠️ |

**Result**: A no-personal-data cookieless dataset needs no Article 6 basis at all. Cookie-based tracking needs one, and legitimate interest is questionable for it — consent is the safer route.

## GDPR Principles and Cookieless Analytics

### Principle 1: Lawfulness, Fairness, Transparency (Article 5(1)(a))

**Lawfulness**: No personal data is processed, so no Article 6 legal basis is required (Recital 26) ✅

**Fairness**:
- Users not deceived
- No hidden tracking
- Processing aligns with reasonable expectations ✅

**Transparency**:
- Privacy policy discloses analytics
- Clear explanation of what's measured
- How to exercise rights ✅

**Cookieless advantage**: Easier to explain ("we count visitors, we don't track you") vs. complex cookie ecosystems.

### Principle 2: Purpose Limitation (Article 5(1)(b))

**Requirement**: Data collected for specified, explicit, legitimate purposes; not further processed incompatibly

**Cookieless analytics**:
- ✅ Clear purpose: Website performance measurement
- ✅ Limited scope: Traffic statistics for website operator's use
- ✅ No secondary uses: Not sold, not used for advertising, not shared

**Compliance**: Purpose limitation naturally satisfied by design.

### Principle 3: Data Minimization (Article 5(1)(c))

**Requirement**: Adequate, relevant, and limited to what is necessary

**Cookieless analytics**:
- ✅ No persistent user IDs (eliminates unnecessary tracking)
- ✅ Aggregated metrics (only what's needed for statistics)
- ✅ No individual profiles (unnecessary for traffic measurement)
- ✅ No personal data in the stored dataset (no IP stored, no identifier, no cross-session linking)

**Gold standard**: Cookieless is **data minimization by design**.

### Principle 4: Accuracy (Article 5(1)(d))

**Requirement**: Personal data must be accurate and kept up to date

**Cookieless analytics**:
- ✅ Aggregate statistics (accuracy inherent in counting)
- ✅ No individual data to be inaccurate
- ✅ Session-based measurement (no stale profiles)

**Benefit**: Less risk of inaccuracy when not maintaining user profiles.

### Principle 5: Storage Limitation (Article 5(1)(e))

**Requirement**: Kept in identifiable form no longer than necessary

**Cookieless analytics**:
- ✅ Session-only tracking (no long-term storage of identifiers)
- ✅ Aggregated data quickly (raw logs not retained long)
- ✅ Typical retention: 24 months maximum (align with AEPD requirements)
- ✅ Aggregated reports can be kept indefinitely (no personal data)

**Best practice**: Delete raw server logs after aggregation; retain only statistics.

### Principle 6: Integrity and Confidentiality (Article 5(1)(f))

**Requirement**: Appropriate security measures

**Cookieless analytics**:
- ✅ Less data to secure (no long-term user profiles)
- ✅ Encryption in transit (HTTPS)
- ✅ Access controls
- ✅ Secure infrastructure

**Reduced risk**: Less valuable to attackers (no persistent user data to breach).

### Principle 7: Accountability (Article 5(2))

**Requirement**: Controller must demonstrate compliance

**Cookieless analytics**:
- ✅ Document why no personal data is processed (the Recital 26 record); a legitimate interest assessment is only needed for identifier-based tools you also run
- ✅ Maintain records of processing activities (Article 30)
- ✅ Privacy policy reflects cookieless approach
- ✅ Data protection by design (Article 25)

**Demonstration**: Easier to show compliance when processing is minimal.

## Data Subject Rights and Cookieless Analytics

### Right of Access (Article 15)

**User request**: "What personal data do you have about me?"

**Cookieless analytics response**:
- **If truly anonymous**: "Our analytics do not process your personal data; we cannot identify you in our statistics."
- **If minimal data (IP in logs)**: "We have server logs with your IP address from [date/time], used for traffic measurement. This data will be deleted after [retention period]."

**Advantage**: Simple response; no extensive user profiles to provide.

### Right to Rectification (Article 16)

**User request**: "Correct inaccurate data about me"

**Cookieless analytics**:
- Not applicable (no individual user profiles to be inaccurate)
- Aggregate statistics are accurate by design

### Right to Erasure (Article 17)

**User request**: "Delete my data"

**Cookieless analytics**:
- **If anonymous**: Not possible (cannot identify user in aggregate data)
- **If IP in logs**: Can delete specific IP entries, or explain scheduled deletion period

**Practical**: Much easier than cookie-based systems tracking users across months/years.

### Right to Restriction (Article 18)

**User request**: "Stop processing my data while we resolve a dispute"

**Cookieless analytics**:
- Rarely applicable (no ongoing individual processing to restrict)
- Can flag IP for non-processing if requested

### Right to Data Portability (Article 20)

**User request**: "Give me my data in portable format"

**Cookieless analytics**:
- Not applicable (Article 20 requires processing based on consent or contract; a no-personal-data dataset relies on neither)
- Even if applied: No meaningful individual data to port (aggregate statistics not "personal data")

### Right to Object (Article 21)

**User request**: "Stop processing my data for analytics"

**Article 21 applies to processing based on Article 6(1)(e) or (f).** Where no personal data is processed, there is no Article 6 processing to object to and no visitor to single out — the right is not engaged.

**Cookieless analytics response**:
- **If truly anonymous** (Sealmetrics): "Our analytics hold no personal data about you, so there is nothing to object to; no record of you exists to be excluded."
- **If minimal data (hashed IP)**: The right applies. Provide a mechanism (e.g., email address in privacy policy) and honor objections.

**Implementation options for tools where the right applies**:
1. **IP exclusion**: Add user's IP to exclusion list (imperfect, dynamic IPs)
2. **Browser signal**: Respect Do Not Track or Global Privacy Control (Sealmetrics does not read these signals itself; a site can skip loading the tracker when they are present)
3. **Opt-out cookie**: Paradoxically, set cookie to exclude from cookieless analytics
4. **Manual request**: User contacts, we exclude their IP or sessions

**Best practice**: Make objection easy and effective where it applies.

## Cookieless Analytics and ePrivacy

### ePrivacy Directive Article 5(3)

**Separate from GDPR**: [Article 5(3) of Directive 2002/58/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058) regulates terminal equipment access (cookies, device fingerprinting)

**Requirement**: Consent for storing/accessing information in terminal equipment

**Exception**: Strictly necessary for service delivery

### Cookieless and ePrivacy Compliance

**Key question**: Do cookieless analytics access/store information in terminal equipment?

**If NO cookies or client-side storage, and nothing is read from the device**:
- ✅ ePrivacy Directive does not apply
- ✅ No consent required under ePrivacy

**If nothing is stored but the script reads browser properties** (for example, to compute a session hash — as Sealmetrics does):
- Reading those properties is "access" under Article 5(3), so the provision is engaged
- The consent exemption then depends on the audience-measurement / strictly-necessary criteria (see [Analytics Cookies Exemption](./analytics-cookies-exemption.md))
- ✅ GDPR is not engaged either when the stored dataset holds no personal data (Recital 26); for tools that keep a hashed IP, GDPR applies and legitimate interest is the usual basis

**If minimal cookies (e.g., session cookie)**:
- "Strictly necessary" exception may apply (if truly needed for service)
- Or analytics exemption under the AEPD framework ([AEPD cookies guide](https://www.aepd.es/guias/guia-cookies.pdf); see [Analytics Cookies Exemption](./analytics-cookies-exemption.md))

**Cookieless advantage**: Nothing is stored on the device; where browser properties are read, the analysis moves to the exemption criteria rather than to consent.

### Digital Omnibus Future Framework

**Article 88a(3)(c)** (when in force):

> "Creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use"

**Explicit consent exemption** for:
- Aggregated measurement
- By controller
- For own use

**Cookieless analytics alignment**: Perfectly aligned with Article 88a(3)(c)

**Learn more**: [EU Digital Omnibus - Cookie Consent Reform](./omnibus/cookies-eprivacy.md)

## Practical Implementation: GDPR-Compliant Cookieless Analytics

### Step 1: Choose Cookieless Solution

**Options**:

**Sealmetrics**:
- Cookieless by design
- Aggregated measurement
- First-party data only
- Meets these criteria out of the box, with no configuration needed

**Server-side analytics**:
- Parse server logs
- Anonymize IPs
- Aggregate metrics
- No client-side tracking

**Privacy-focused platforms**:
- Plausible (cookieless mode)
- Fathom Analytics
- Simple Analytics
- Matomo (cookieless configuration)

### Step 2: Configure for Privacy

**If using Sealmetrics**: the default configuration already meets the criteria above

**If using other tools**:
- ✅ Disable cookies
- ✅ Disable user ID tracking
- ✅ Disable cross-site tracking
- ✅ Enable IP anonymization
- ✅ Limit data retention (24 months max recommended)
- ✅ Disable any advertising features
- ✅ Ensure first-party data only

### Step 3: Document Why No Personal Data Is Processed

**No legitimate interest assessment is required** for a tool that processes no personal data: the three-part test exists to justify Article 6(1)(f) processing, and there is none. What accountability (Article 5(2)) calls for instead is a short record showing why the dataset sits outside the GDPR:

1. **What is collected**:
   - A small set of non-identifying fields (page, referrer, device category, country from browser timezone, and a session identifier re-keyed daily — see [What We Track](/security-privacy/what-we-track))
   - Aggregated traffic statistics only

2. **Why it is not personal data** (Recital 26):
   - No IP address stored, not even hashed
   - No cookie, local storage or other stored identifier on the device
   - No cross-session linking; no visitor can be singled out
   - Nothing written to the device (browser properties are read only to compute the daily-re-keyed session identifier)

3. **Conclusion**: No personal data is processed, so no Article 6 basis (consent or legitimate interest) is needed.

**If you also run identifier-based tools** (a cookie-based analytics platform, ad pixels, a tag manager that sets identifiers): those *do* process personal data and still need a legitimate interest assessment or consent for that processing. Document them separately.

**Retain this record**: For accountability (Article 5(2))

### Step 4: Update Privacy Policy

**Required disclosures**:

```markdown
## Website Analytics

We use cookieless analytics to understand how visitors use our website. This helps us improve content and user experience.

### What We Measure
- Pages visited
- Referrer (where you came from)
- Device type and browser
- Geographic location (country/region)
- Time spent on pages

### What We Don't Do
- We do not use cookies to track you
- We do not track you across websites
- We do not build individual user profiles
- We do not sell or share your data
- We do not use your data for advertising

### Legal Basis
Our website analytics do not process personal data. No IP address is stored, no cookie or identifier is set, and no visitor can be singled out. Under GDPR Recital 26 this information is anonymous and falls outside the Regulation, so no legal basis under Article 6 (consent or legitimate interest) is required for it.

### Your Rights
Because our analytics hold no personal data about you, there is nothing in them to access, correct, delete or object to. You keep every right under the GDPR over any personal data we process elsewhere (for example an account or a support request).

For any question, contact: [privacy@example.com]

### Data Retention
Analytics data is retained for 24 months, then deleted.

### Analytics Provider
We use [Sealmetrics/other provider], which acts as our data processor and does not use data for their own purposes.
```

### Step 5: Opt-Out Mechanism (Where One Is Needed)

**With no personal data processed, no opt-out is legally required** — there is no record of the visitor to exclude. Offering one remains a courtesy some publishers choose.

**Technical opt-out** (courtesy, or required for identifier-based tools you also run):
- Respect Do Not Track or Global Privacy Control. Sealmetrics does not read either signal, so honouring them means not loading the tracker when they are present — see [GPC and DNT signals](/compliance/gpc-dnt-signals)
- Provide a dedicated opt-out page

**Best practice**: If you offer it, make it easy; few users will actually opt out of non-invasive cookieless analytics.

### Step 6: Maintain Records

**[Article 30 GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)**: Record of processing activities

**Required information**:
- Name and contact details of controller
- Purposes of processing (website analytics)
- Categories of data subjects (website visitors)
- Categories of data (state expressly that no personal data is stored: no IP, no identifier; for hashed-IP tools, list the IP as personal data)
- Categories of recipients (analytics provider, if any)
- Retention periods (24 months)
- Security measures

**Maintain this record**: Available for supervisory authority if requested.

## Common Questions

### Do I need a cookie banner for cookieless analytics?

**Not necessarily.** If nothing is stored on or read from the device, the ePrivacy consent requirement does not apply. If the script reads browser properties (as Sealmetrics does to compute its session identifier), Article 5(3) is engaged and the exemption depends on the audience-measurement criteria — see [Analytics Cookies Exemption](./analytics-cookies-exemption.md).

**GDPR is not engaged either** when nothing stored identifies a visitor: no IP (hashed or otherwise), no identifier, no cross-session linking. Under Recital 26 that dataset is anonymous and needs no legal basis — neither consent nor legitimate interest.

### Can I use cookieless Google Analytics?

**Google Analytics 4** has a "cookieless mode" but:
- Data still transferred to Google
- Google may use data for its purposes
- May not qualify for GDPR legitimate interest
- May still require consent

**Recommendation**: Use purpose-built cookieless analytics (Sealmetrics, Plausible, Fathom) for genuine compliance.

### Is IP address personal data?

**Yes**, under GDPR (confirmed by the CJEU in [*Breyer*, C‑582/14](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582)).

**Tools that store a hashed IP** therefore still process personal data and need an Article 6 basis — usually legitimate interest, subject to the assessment above, with limited purpose, limited retention and pseudonymization.

**Sealmetrics**: never stores the IP, hashed or otherwise, so the analytics dataset holds no personal data. The only touch is a transient in-memory check for bot and abuse filtering, which Recital 49 covers as security processing and which never reaches the analytics data (see [How Sealmetrics Blocks Bot Traffic](/compliance/compliance-overview/how-sealmetrics-blocks-bot-traffic)).

### What about device fingerprinting?

**Device fingerprinting** = Combining browser/device characteristics to create a persistent unique identifier for tracking users across sessions.

**GDPR status**: Persistent device fingerprinting creates personal data and requires legal basis (typically consent).

**ePrivacy status**: Accessing device information to build persistent identifiers may require consent under Article 5(3).

**Sealmetrics**: The tracker computes, in the browser, a hash of standard device characteristics (a device fingerprint) to tell a second pageview from a new entrance. It is never written to the device and never stored as sent: the server re-keys it with a daily salt that is destroyed on rotation, so the stored identifier changes every day and cannot link a device across days or sessions. See [What We Track](/security-privacy/what-we-track#6-session-identifier).

### How long can I retain cookieless analytics data?

**GDPR Storage Limitation** (Article 5(1)(e)): No longer than necessary

**Best practice**:
- **Raw data (IP addresses, logs)**: 24 months maximum (aligns with AEPD)
- **Aggregated statistics**: Indefinitely (no personal data)

**Recommended approach**:
1. Collect raw data
2. Aggregate into statistics daily/weekly/monthly
3. Delete raw data after aggregation (or after 24 months max)
4. Retain aggregated reports indefinitely

### Can I share cookieless analytics data?

**With data processor** (Article 28): Yes, if:
- Data Processing Agreement in place
- Processor only acts on your instructions
- Processor does not use data for own purposes

**With third parties for their purposes**: No, unless:
- Data is truly anonymous (aggregated to point of non-identification)
- OR you obtain consent
- OR another Article 6 basis applies

**Best practice**: Keep analytics data in-house; only share truly anonymous statistics.

## Cookieless Analytics and Data Transfers

### GDPR Chapter V: International Transfers

**If analytics data transferred outside EU/EEA**:

**GDPR requirements**:
- Adequacy decision, OR
- Appropriate safeguards (Standard Contractual Clauses, Binding Corporate Rules), OR
- Derogations (consent, contract, etc.)

**Cookieless advantage**:
- Less data to transfer (no user profiles)
- Can keep data in EU more easily (self-hosted or EU providers)

**Sealmetrics**: customer analytics data stays in the EU (Dublin), so Chapter V transfer rules are not engaged for it.

**US-based analytics**: Proceed with caution post-Schrems II; ensure SCCs and supplementary measures.

## Comparison: Cookie-Based vs. Cookieless

| Aspect | Cookie-Based Analytics | Cookieless Analytics |
|--------|------------------------|----------------------|
| **GDPR legal basis** | Consent (usually) or contested legitimate interest | None required when no personal data is stored (Recital 26); legitimate interest only for tools that keep a hashed IP |
| **ePrivacy requirement** | Consent required | Not applicable (no cookies) |
| **Cookie banner** | Required | Not required |
| **Data subject rights** | Complex (years of profiles) | Simple (minimal data) |
| **Consent rate** | 50-80% (data loss) | N/A (no consent needed) |
| **Privacy impact** | High (tracking over time) | Low (session-only) |
| **User experience** | Interrupted (banner) | Seamless (no banner) |
| **Compliance complexity** | High | Low |
| **Cost** | High (CMP, legal review) | Low (no CMP needed) |
| **Data quality** | Skewed (consent bias) | Complete (all visitors) |

**Clear winner**: Cookieless analytics for privacy, compliance, UX, and data quality.

## Primary sources

- GDPR (Regulation 2016/679) — Art. 4(1) defines personal data; Recital 26 excludes anonymous data — [eur-lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)
- ePrivacy Directive 2002/58/EC — Art. 5(3): consent to store or access terminal-equipment data — [eur-lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058)
- EDPB Guidelines 2/2023 — technical scope of Art. 5(3): what counts as storage or access — [edpb.europa.eu](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en)
- Art. 29 WP Opinion 04/2012 (WP194) — cookie consent exemption, including first-party analytics — [ec.europa.eu](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf)
- CNIL — audience-measurement exemption criteria for consent-free analytics — [cnil.fr](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies-solutions-pour-les-outils-de-mesure-daudience)
- AEPD — Guía sobre el uso de las cookies, analytics-cookie exemption conditions — [aepd.es](https://www.aepd.es/guias/guia-cookies.pdf)

## Related Resources

- [Analytics Cookies Exemption Requirements](./analytics-cookies-exemption.md) - AEPD and EU DPA guidance on analytics without consent
- [EU Digital Omnibus - Cookie Consent Reform](./omnibus/cookies-eprivacy.md) - Future framework for analytics under Article 88a
- [EU Digital Omnibus - Impact on Analytics](./omnibus/impact-analytics.md) - How regulations affect analytics industry
- [Is Sealmetrics GDPR, ePrivacy, CCPA, and PECR Compliant?](/compliance/compliance-overview/is-sealmetrics-privacy-compliant) - How the isolated-hit model applies these principles
- [Do Temporary Session Identifiers (Session IDs) Require Consent Under GDPR?](/legal/gdpr-and-eprivacy/do-session-ids-require-consent) - When session identifiers stay consent-exempt
- [Why Sealmetrics Can Measure Without Consent](/security-privacy/why-no-consent) - The technical basis for consentless measurement

## Key Takeaways

1. **Cookieless analytics can comply with GDPR** without consent banners
2. **No Article 6 basis is needed** when no personal data is processed (Recital 26) — Sealmetrics relies on neither legitimate interest nor consent for visitor analytics
3. **ePrivacy consent not required** when nothing is stored on or read from the device; where browser properties are read, the audience-measurement exemption criteria decide
4. **Data minimization by design**: Cookieless naturally satisfies GDPR principles
5. **Simpler data subject rights**: Minimal data = minimal rights management
6. **No cookie banner needed**: Better UX, complete data, lower costs
7. **Future-proof**: Aligns with Digital Omnibus Article 88a(3)(c)
8. **Document the Recital 26 analysis**: Record why no personal data is processed; a legitimate interest assessment is only needed for identifier-based tools you also run
9. **Privacy policy disclosure**: Required even for cookieless analytics
10. **Right to object**: Arises only where personal data is processed; not engaged for a no-personal-data dataset

Cookieless analytics represent the evolution of privacy-respecting measurement. By eliminating persistent tracking while maintaining statistical accuracy, they satisfy both GDPR requirements and user expectations for privacy. As the Digital Omnibus makes clear, aggregated audience measurement for own use is not invasive surveillance—it's legitimate business intelligence. Cookieless analytics embody this principle in practice.