Do I need a cookie banner for website analytics?

Facts checked on October 22, 2026, each against its source. Every number links to where it came from.

This is a plain-English summary of the rules, not legal advice. If your business depends on the answer, ask a lawyer who knows your market.

Why "cookie" is the wrong word to look for

The European rule that started cookie banners never mentions cookies. Article 5(3) of the ePrivacy Directive covers storing information on a person's device, or reading information already stored there, and allows it only with their consent, unless it's strictly necessary for a service they asked for¹.

The UK regulator reads its version the same way. The ICO lists cookies, tracking pixels, link decoration, web storage, fingerprinting, and scripts and tags as technologies the rules apply to². And the European Data Protection Board's guidelines, adopted in October 2024, say tracking pixels, tracking links and even tracking based on IP addresses can fall under the same rule³.

So "we don't use cookies" doesn't answer the question in Europe. The rules turn on what the tool stores or reads, what it does with it, and who else gets it.

In the United States

Congress hasn't passed one comprehensive consumer privacy law; it has passed laws for particular industries and kinds of data⁴. The states are where the rules are, and California's is the one most people mean.

California's law applies to a for-profit business that does business in the state and meets one of three tests: gross annual revenue over $26,625,000 (the adjusted figure since January 1, 2025)⁵, or buying, selling or sharing the personal information of 100,000 or more California residents or households a year, or making half or more of its revenue from selling or sharing it⁶. Many small businesses meet none of these.

For a business it does cover, the law asks for two things, neither of them a banner:

• A notice. At or before the point of collection, say what categories of personal information you collect, why, and whether you sell or share it⁷.
• A way to opt out, if you sell or share. A business that sells or shares personal information needs a "Do Not Sell or Share My Personal Information" link, or must honor an opt-out signal from the browser instead⁷. Sharing here means passing data on for advertising that follows people across sites, which is what ad pixels do.

That browser signal is Global Privacy Control. California's Attorney General says covered businesses must honor it as a request to stop selling or sharing⁸, and Colorado has required businesses its law covers to honor it since July 1, 2024⁹.

In the United Kingdom

The UK changed its rule this year. Since February 5, 2026¹⁰, the Data (Use and Access) Act lets a site store or read information on a device without consent when the only purpose is collecting statistics about how the site is used so it can be improved¹¹. The conditions:

• The information isn't shared, except with someone helping you improve the site.¹¹
• Visitors get clear and comprehensive information about the purpose.¹¹
• Visitors get a simple, free way to object, and haven't objected.¹¹

The ICO calls this "essentially for analytics purposes" but "not a broad exception": it's about how your site is used, not who uses it, and it doesn't cover identifying or tracking people, or advertising¹². So for analytics that stays within it, a UK visitor gets a clear notice and an easy way to say no, instead of a consent banner.

In the European Union

The EU directive itself has no analytics exemption: the only way around consent is "strictly necessary", and the directive doesn't mention statistics. Some national regulators have set conditions under which they treat analytics as exempt. France's CNIL, for one, exempts audience measurement used only for the site's own statistics, producing anonymous figures, never combined with other data, never passed on to third parties unless anonymous, and never following people across sites. It suggests, for example, 13 months for the trackers and no more than 25 months for the data¹³.

The details differ from country to country, and the EDPB says each case has to be assessed: falling under the rule doesn't always mean consent is needed, because an exemption may apply³.

What to check about your own site

• Check whether your analytics sets cookies or uses local storage. Many tools do by default, and some can be switched to work without.
• Check whether the provider uses your visitors' data for its own purposes. If so, it falls outside the UK exception and the CNIL exemption alike.
• Check whether it follows people across sites or keeps a record of each visitor. The ICO lists logs or recordings of individual visitors, and tracking or profiling them, as needing consent¹².
• Look at what else is on the page. Ad pixels, embedded videos, chat widgets and maps can set cookies of their own. A privacy-friendly analytics tool doesn't make the rest of the page consent-free.
• Make sure your privacy notice says what you use. Every rule above expects one.

Where Nodium fits

Nodium's script sets no cookies and stores nothing on the visitor's device, never stores the IP address, and doesn't count a browser that sends Do Not Track or Global Privacy Control¹⁴. Its privacy docs give you a sentence for your privacy notice. Whether counting without cookies needs consent where your visitors are is still a legal question for you and your adviser, and we'd rather say so than guess.