Skip to main content

What is Consentless Analytics?

Consentless analytics is a method of measuring website traffic and user behavior without requiring visitor consent. It achieves this by not collecting personal data, not setting cookies, and not using any form of user identification — making consent legally unnecessary under GDPR, ePrivacy Directive, and other privacy regulations.

Traditional analytics tools like Google Analytics 4, Adobe Analytics, and Mixpanel rely on cookies and client-side identifiers to track individual users. Under GDPR, these tools require explicit consent before activation. When a visitor rejects consent, the tool records nothing — which is why cookie-based analytics typically lose 15–60% of visitor data in EU markets — how much depends on sector, brand strength and traffic mix. The result: businesses make decisions based on a fraction of their actual traffic.

Consentless analytics solves this by measuring aggregate behavior rather than tracking individuals. Every visitor is measured. Every page view is counted. Every conversion is attributed to its source. No consent is needed because no personal data is involved.

How It Works: The Four-Variable System​

Sealmetrics uses a consentless tracking approach built on four non-identifying variables per event:

  1. Timestamp — when the event occurred
  2. User Agent — browser and device type (used for anonymous device classification; the event-level raw string is purged after 1 day)
  3. Current URL — the page being viewed
  4. Referral URL — where the visitor came from

That is all. No cookies, no IP addresses stored, no fingerprinting, no localStorage, no sessionStorage, no cross-session linking.

This minimal dataset makes it technically impossible to identify any individual visitor, which is why consent is not required. For a deeper technical explanation, see How Consentless Tracking Works.

Consentless analytics does not require consent because it falls outside the scope of both GDPR and the ePrivacy Directive:

GDPR (Regulation 2016/679)​

GDPR applies to the processing of personal data — information that relates to an identified or identifiable natural person (Article 4(1)). Consentless analytics does not process personal data:

  • No IP addresses are stored
  • No user identifiers are generated
  • No behavioral profiles are built
  • No cross-session tracking occurs

When no personal data is processed, GDPR consent requirements (Article 6) do not apply. Additionally, Recital 26 states that anonymized data falls outside the regulation's scope.

ePrivacy Directive (2002/58/EC)​

Article 5(3) of the ePrivacy Directive requires consent for storing or accessing information on a user's terminal equipment (cookies, localStorage, etc.). Consentless analytics does not store or access any information on user devices, so Article 5(3) does not apply.

Regulatory Guidance​

Privacy authorities have explicitly recognized that certain analytics tools can operate without consent:

  • CNIL (France) — Published criteria for analytics tools exempt from consent. Tools that do not track individuals, do not enable cross-site tracking, and aggregate data can operate without consent banners.
  • AEPD (Spain) — Allows audience measurement without consent when data is aggregated daily and no personal identification is possible.
  • ICO (United Kingdom) — Under the DUAA 2025 update to PECR, strictly necessary analytics cookies are exempt from consent.

Sealmetrics has completed self-assessments against CNIL criteria and UK PECR criteria, both available publicly in the compliance section. No supervisory authority certifies or approves analytics tools, and Sealmetrics holds no third-party security certification such as ISO 27001 or SOC 2 — those pages are our own assessments against published criteria, not external validations.

For a full legal analysis, see GDPR and Cookieless Analytics.

What this means for you as the data controller​

  • No consent banner is required for Sealmetrics measurement, and no Consent Management Platform, Consent Mode configuration or conditional tag firing is needed.
  • A DPA is included — public and ready to sign at sealmetrics.com/dpa. Your DPO will ask for one, so we provide it out of the box rather than arguing it is unnecessary. Annex 3 of that DPA is the authoritative subprocessor list.
  • One paragraph in your privacy policy. The AEPD audience-measurement guidance asks you to inform visitors about audience measurement; we provide ready-made wording.
  • Vendor review material is collected in the compliance section, including the self-assessments above.
Cookie-Based (GA4, Adobe)Consentless (Sealmetrics)
Tracking methodCookies + client IDAggregate event measurement
Consent requiredYesNo
Data capture (EU)Partial — 15–60% of visitor data lost to consent rejectionEvery hit measured
Cookie bannersRequiredNot needed
Personal dataYes (client ID, IP)No
Cross-session trackingYesNo
User-level profilesYesNo
Data hostingOften US-basedEU-only (Dublin, Ireland)
Script size50–365 KB1.3 KB (gzipped)

The trade-off is clear: cookie-based tools offer user-level metrics (unique visitors, session duration, cohort analysis) but lose a large share of their data to consent rejection. Consentless analytics measures every visit but reports aggregate behaviour rather than individual journeys.

For most business decisions — which campaigns drive revenue, which pages convert, where traffic comes from — aggregate data covering all visitors is more useful than user-level data covering only those who accepted a banner.

What Consentless Analytics Can and Cannot Measure​

What it measures​

  • Page views and entrances (aggregate)
  • Traffic sources (UTM parameters, referrers)
  • Conversions and revenue
  • Funnel progression (anonymous steps)
  • Geographic distribution (country-level)
  • Device and browser breakdown
  • Campaign performance and ROAS
  • Content performance (pages, groups)
  • Real-time traffic (aggregated snapshots)
  • Within-session engagement — bounce rate, engaged entrances, engagement rate and pages per session, all computed from the short-lived session marker described in What We Track

What it cannot measure​

  • Unique visitors — requires identifying returning individuals
  • Session duration — requires timing an individual session from start to end
  • The page a visit ended on, and navigation paths — both require sequencing one visitor's pageviews
  • User journeys across sessions — requires linking page views to a single person over time
  • Cohort analysis — requires identifying users over time

These metrics are excluded by design, not by limitation. Tracking them would require a persistent identifier, which is personal data, which would require consent — defeating the purpose of consentless analytics.

Sealmetrics provides entrances instead of unique visitors as the audience-size signal. See the Metrics Reference for the exact formula behind each metric.

How Sealmetrics Implements Consentless Analytics​

Sealmetrics uses two complementary tracking methods:

Session-Based Tracking​

A temporary session identifier is generated when a visitor arrives. This ID exists only for the duration of the browser session and is never persisted. It enables grouping page views within a single visit without identifying the visitor.

Key properties:

  • Expires when the browser tab/window closes
  • Cannot be linked to a person
  • Cannot be used across sessions
  • Not stored on disk (no cookies, no localStorage)

Isolated Hit Tracking​

Each page view is recorded as an independent, anonymous event. No attempt is made to link hits to a user or to other hits. This provides the most privacy-preserving form of measurement: pure aggregate counting.

Both methods can run simultaneously or independently, depending on the account configuration. See tracker documentation for technical details.

How data flows​

  1. Event detection — the JavaScript tracker detects a page view or event. Nothing is written to or read from the device: no cookies, no localStorage, no sessionStorage, no fingerprinting.
  2. Transmission — the hit is sent as a lightweight beacon request to Sealmetrics' EU infrastructure. IP addresses appear at the network layer as they do for any HTTP request, but are never persisted in the analytics database; they are used in memory only for anti-abuse checks and site-configured exclusions.
  3. Processing — each hit is processed on its own. Hits are not joined to a person, and are not linked across sessions.
  4. Aggregation and reporting — dashboards report statistical patterns. Event-level detail is short-lived: it is purged after 1 day, hourly aggregates are kept 90 days, and daily aggregates and conversions 24 months. Retention is fixed for every plan and enforced by database TTLs — see Data Location & Retention.

All processing and storage of customer analytics data happens in Dublin, Ireland.

Practical effects of having no identifiers​

  • Nothing for privacy tooling to strip. Ad blockers and browser tracking protections such as ITP target identifiers and known tracking domains; Sealmetrics sets none and uses its own domain, so measurement stays consistent across Safari, Firefox and private browsing modes.
  • No CMP dependency. No cookie categorisation, no Consent Mode v2, no region-conditional GTM triggers, and no re-testing the analytics setup every time a banner changes.
  • No consent-driven attribution gaps. UTM values are read on arrival rather than after a banner interaction, so traffic is not misfiled as Direct when a visitor accepts cookies mid-journey.
  • Light footprint. The tracker is 1.3 KB gzipped, loads asynchronously and does not block rendering.

Implementation​

Adding consentless analytics to any website requires one line of code:

<script src="https://t.sealmetrics.com/t.js?id=YOUR_ACCOUNT_ID" defer></script>

No consent management platform needed. No cookie banner configuration. No Consent Mode setup. The tracker loads asynchronously (1.3 KB gzipped), detects SPA navigation automatically, and begins capturing data immediately.

For platform-specific installation, see guides for WordPress, WooCommerce, Shopify, Next.js, and more integrations.

Who Uses Consentless Analytics​

Consentless analytics is particularly valuable for:

  • E-commerce businesses that need accurate conversion and revenue data for budget allocation
  • Marketing teams that need reliable campaign attribution across all EU markets
  • Companies in regulated industries (finance, healthcare, government) where minimizing data collection reduces compliance risk
  • Multi-market businesses operating across EU countries with different consent rejection rates
  • Performance-focused teams that want a lightweight tracker without page speed impact

Frequently Asked Questions​

For aggregate metrics (total traffic, conversions, source attribution), consentless analytics is more accurate because it captures 100% of traffic. Cookie-based tools only measure the subset of visitors who accept consent, which creates a biased sample.

Can consentless analytics track returning visitors?​

No. Identifying returning visitors requires storing a persistent identifier, which constitutes personal data. Consentless analytics treats every session as independent. If you need returning visitor analysis, you would need a consent-based tool for that specific metric.

Does consentless analytics work with Google Ads?​

Yes. Sealmetrics reads UTM parameters from Google Ads URLs and attributes conversions and revenue to campaigns. It provides ROAS reporting at the campaign, source, and medium level. However, it does not sync audience data back to Google Ads for automated bidding.

Is this the same as server-side analytics?​

No. Server-side analytics (like log analysis) processes server access logs. Consentless analytics uses a client-side JavaScript tracker that fires on page load and user events. The key difference is that consentless analytics captures JavaScript-dependent events (SPA navigation, conversions, form submissions) that server logs cannot see.

How is this different from Plausible or Fathom?​

Plausible and Fathom are privacy-focused analytics tools, but they use hashed IP addresses for visitor identification. Some legal experts argue that hashed IPs still constitute personal data under GDPR. Sealmetrics never processes visitor IP addresses for analytics or geolocation — visitor country is derived from the browser timezone (Intl.DateTimeFormat().resolvedOptions().timeZone), not from IP. IPs are only handled in-memory at the edge for anti-bot checks and site-configured exclusions, and are never persisted. See the country detection page and the Sealmetrics vs Plausible comparison for details.

Learn More​

Ready to see your real traffic numbers? Start a free trial — setup takes under 5 minutes, no cookie banner required.