Skip to main content

Why Sealmetrics Can Measure Without Consent

Sealmetrics needs no consent banner because it collects no personal data and stores nothing on the visitor's device. Two separate rules are in play, and neither one attaches:

  • GDPR governs the processing of personal data. Sealmetrics stores no IP address, no user ID, no persistent identifier and no profile, so the obligations that apply to personal data — including the consent question — are not triggered.
  • The ePrivacy Directive (Article 5(3)) requires consent to store or read information on a user's terminal equipment. Sealmetrics sets no cookies and uses no localStorage or sessionStorage, so there is nothing on the device to ask about.

What Sealmetrics records instead is four non-identifying variables per hit: timestamp, user agent (used for anonymous device classification — the raw string is purged after 1 day, and only the derived browser/OS/device categories persist in aggregates for 24 months), current URL and referral URL. Hits are measured on their own; they are never joined to a person or linked across sessions.

This distinction matters more than it looks. Under ePrivacy, tracking individuals requires consent even when the tracking is anonymous — which is why moving tags server-side does not remove the consent requirement. Sealmetrics does not track individuals at all, which is a different thing from tracking them anonymously.

Both the CNIL (France) and the AEPD (Spain) have published criteria under which audience measurement can operate without consent, and Sealmetrics has self-assessed against them. To be clear about what that is and is not: no supervisory authority certifies or approves analytics tools, so the compliance pages are our own assessments against published criteria, not third-party validations. Sealmetrics also holds no ISO 27001 or SOC 2 certification. A Data Processing Agreement is included and ready to sign at sealmetrics.com/dpa.