Website Analytics Tools: Pick One Without a Consent Banner

A web developer working at a wooden desk behind an open laptop with a cup of coffee beside them.

Website analytics tools fall into two camps. Cookie-based suites follow individual visitors across sessions, mainly to feed advertising. Cookieless tools count visits, sources and pages without storing anything on the visitor's device. Under Article 5(3) of the EU ePrivacy Directive, storing or reading data on a device generally requires consent. That means the first camp usually needs a banner and loses data from everyone who declines, while the second often does not.

TL;DR:

  • Cookie-based analytics generally needs a consent banner in the EU and UK, and every "decline" click is a visit you never see.
  • "Cookieless" only helps if the tool also avoids local storage and fingerprinting, because EU law covers any storage on or reading from a device.
  • Judge tools on five things: consent requirements, script weight, where the data lives, multi-site support, and how much you have to learn.
  • Cookieless tools give up long-term individual tracking and advertising attribution, which most small sites never use anyway.
  • If you run several sites on different platforms, one board showing all of them saves more time than any single report.
REPLASTATS

Want analytics without a consent banner?

See how ReplaStats tracks visitors, sources and pages without storing anything on their device.

Visit →

Table of Contents

Most comparison pages sort analytics tools by feature count. That is the wrong place to start. The first question is whether the tool stores an identifier on your visitor's device, because that one choice decides whether you need a consent banner, how much of your traffic you actually see, and how much legal risk you carry.

Cookie-based suites. These tools set a persistent identifier so they can recognize the same browser across visits, sometimes for months. That supports returning-visitor analysis, cross-session funnels and advertising attribution. In the EU and UK it generally also means asking permission first.

Cookieless tools. These count page views, referrers, countries and devices without leaving anything behind on the device. A "unique visitor" is typically estimated within a short window, often a single day, using data that is never stored on the visitor's machine. You lose lifetime tracking of individuals. In most setups you also lose the banner.

The legal basis for this split is short. Article 5(3) of the EU ePrivacy Directive requires consent before storing information on, or accessing information from, a user's device. The only exceptions are cases strictly necessary to deliver a service the user asked for. Visitor statistics usually don't count as strictly necessary. The cookie banner exists because of this rule.

Article 5(3) of the ePrivacy Directive never says "cookies only." It covers storing or accessing any information on a user's device, which is why local storage and fingerprinting don't slip past it.

A commuter on a bus tapping a smartphone, with the back of the phone facing the viewer.

A banner is not just a design nuisance. When analytics depends on consent, anyone who clicks "reject" or ignores the banner becomes invisible to your reports. Your numbers stop describing your audience. They describe the part of your audience that clicks "accept," and that group skews in ways you can't measure.

The practical costs pile up quickly:

  • Undercounted traffic. Campaign results, top-page rankings and conversion rates are all calculated on a partial sample. You have no reliable way to know how partial.
  • A slower first impression. The banner script, the analytics script and the consent logic all load before your visitor has read a word.
  • Ongoing compliance work. Someone has to configure the categories, keep the vendor list current, and check that nothing fires before consent is given.

Regulators have looked closely at the gray area. France's data protection authority, the CNIL, has long held that some audience measurement can be exempt from consent if it is strictly limited. The tool has to produce anonymous statistics for the site owner only, and the data cannot be combined with other processing or passed to third parties. That is the territory a well-built cookieless tool aims to occupy.

How to Compare Website Analytics Tools: Five Criteria That Matter

Feature lists all look the same after a while. These five criteria separate the tools in ways you will notice every week.

1. What it stores on the device

Ask the vendor directly: does the script set cookies, write to local storage or session storage, or build a device fingerprint? The European Data Protection Board's guidelines on the technical scope of Article 5(3) make clear that the rule reaches well beyond cookies. A tool that swaps cookies for fingerprinting has not solved the consent problem. It has hidden it.

2. Script weight and loading behavior

Analytics should never be the reason your page is slow. Look for a small script, ideally a few kilobytes, loaded with defer or async so it never blocks rendering. Heavy tag-manager setups can add far more weight than the analytics itself.

3. Where your data lives

Some tools, particularly WordPress plugins, write every page view into your site's own database. On a busy site, that table grows indefinitely and slows backups and queries. A tool that keeps data on its own servers leaves your database alone. We cover this trade-off in detail in our guide to WordPress analytics without database bloat.

4. Multi-site and multi-platform support

If you run a Shopify store, two WordPress sites and a Webflow landing page, check that one account covers all of them. Then check whether you can see every site at once, or only by switching between them one at a time.

5. Learning curve

A tool you never open is worthless, however powerful it is. If you need a training course to answer "where did yesterday's traffic come from?", you will end up not asking.

Pro Tip: Don't take "cookieless" on trust. Install the trial script on a test page and open your browser's developer tools. In Chrome, check the Application tab under Cookies, Local Storage and Session Storage after the page loads. If anything new from the analytics domain appears there, the tool is storing data on the device. While you're there, check the Network tab for the script's actual transfer size.

Side by Side: The Four Types of Analytics Setup

Setup Consent banner in the EU/UK? Typical script weight Where data lives Best for
Cookie-based suite Usually yes Heavy, especially with a tag manager Vendor's servers, often shared with ad systems Ad-funded sites that need cross-session attribution
Cookieless hosted tool Often no, if nothing is stored or read on the device A few KB Vendor's servers, separate from your site Small businesses, freelancers, multi-site owners
Self-hosted analytics Depends on configuration Varies Your own server, which you maintain Teams with a sysadmin and strict data-residency needs
Server log analysis No script involved None Your hosting logs Rough traffic counts; bots muddy the numbers

A word on self-hosting: running analytics on your own server does not take you outside GDPR. The EU Court of Justice ruled in Breyer (C-582/14) that a dynamic IP address can be personal data. Your own server still has to handle visitor data lawfully under the GDPR. Self-hosting changes who holds the data. It does not change the rules.

Running Several Sites on Different Platforms Is Where Most Tools Break Down

Hands sorting cables next to a stack of three closed laptops on a desk.

Freelancers and small agencies hit a problem that single-site comparisons ignore. Each platform pushes its own built-in stats, and each one measures differently. Shopify's numbers won't match Squarespace's, and neither matches what a WordPress plugin reports. Putting them side by side compares figures that were never measured the same way.

You need the same measurement method across every site, which means one script that works anywhere you can add a tag to the <head>. You also need a view that answers "is anything on fire across my sites today?" without ten logins. A board that lists every site with today's visitors and a trend line beats a deep report you have to open site by site.

If you manage more than three sites, the most valuable analytics screen isn't a report. It's the one that shows every site at once, so you notice a traffic drop on Tuesday, not at the end-of-month client call.

For WordPress specifically, check whether the plugin shows reports inside wp-admin and what it adds to page load. Our breakdown of WordPress analytics plugins that won't bloat your site walks through what to check.

What Cookieless Tools Can't Tell You, and When You Need the Heavier Option

Being honest about the limits will save you a bad purchase.

  • No long-term individual journeys. You won't see that one person visited six times over three weeks before buying. Daily-unique counts are estimates, not identities.
  • Weaker paid-ad attribution. If you spend heavily on ads and need view-through or multi-touch attribution tied to ad platforms, a cookieless tool won't replace that.
  • Referrer gaps. Many email clients and mobile apps strip the referrer header, so that traffic shows up as "direct." Add UTM parameters to newsletter and social links so those campaigns are credited correctly.
  • Session replays and heatmaps are a separate decision. They record far more about how people use a page than visit counts do. Mask form fields, and check how any replay tool handles text input before you switch it on.

If most of your revenue depends on optimizing large ad budgets, a cookie-based suite with a properly configured consent banner may still be the right call. For most content sites, small shops, portfolios and client sites, the questions you actually ask are simpler. Where did visitors come from, which pages work, and is traffic up or down? A cookieless tool answers those with full data rather than a consented sample.

Which Website Analytics Tool We'd Pick, by Situation

Three colleagues in conversation around a small meeting table with coffee cups and a closed laptop.

Here is where we land:

  • One blog or portfolio site: a free cookieless tier. You don't need more, and you don't need a banner.
  • A WordPress site that's grown busy: a cookieless tool with a lightweight plugin that stores data off-site. Avoid any plugin that logs hits into your own database.
  • Several client sites across platforms: a cookieless tool with a multi-site board. Same method everywhere, one screen.
  • An ad-heavy ecommerce operation: a cookie-based suite with proper consent, possibly alongside a cookieless tool for honest traffic totals.
  • A regulated organization with strict residency rules: self-hosted, and only if someone on staff will maintain it.

If price is what's pushing you to switch, read how to find a cheaper privacy analytics alternative without traps first. Usage-based billing and short data retention catch many people out. Once you've picked a tool, our guide to analyzing traffic without drowning in dashboards covers the handful of numbers worth checking each week.

See Every Site's Traffic on One Screen, With No Banner to Maintain

Replastats was built for the multi-site, multi-platform situation described above. One 4.7 KB deferred script works on WordPress, Shopify, Squarespace, Wix, Webflow, JavaScript frameworks or plain HTML. For WordPress there is a pre-connected plugin that shows reports inside wp-admin. It is cookieless and needs no consent banner. Your data sits on a separate server, never in your site's database, so you get visitors, sources, top pages and live traffic without the bloat.

The free tier covers a single site. Starter adds longer history plus session replays and heatmaps. Pro and Agency add the multi-site board and the ability to ask Claude questions about your analytics. One honest caveat: Replastats won't give you long-term individual journeys or ad-platform attribution, by design. If that is your core need, it's the wrong fit. Whatever you choose, ours included, run the developer-tools check from the Pro Tip above before you trust any "cookieless" claim.

Frequently Asked Questions

Often not, as long as the tool stores nothing on the visitor's device and reads nothing from it. That includes local storage and fingerprinting, not just cookies. Check what the script actually does before relying on the claim, and confirm the rules where your audience lives.

Are cookieless analytics accurate?

For traffic totals, sources and top pages, they are often more complete than consent-dependent tools, because visitors who decline cookies are still counted. Unique-visitor figures are estimates within a short window rather than lifetime identities. Email and app traffic may appear as "direct" unless you tag links with UTM parameters.

Is self-hosted analytics automatically GDPR compliant?

No. The EU Court of Justice held in the Breyer case that a dynamic IP address can be personal data. Self-hosting changes who holds the data, but you still need a lawful basis and appropriate handling under GDPR.

Can one analytics tool track WordPress, Shopify and Webflow sites together?

Yes, if it uses a single script you can add to any site's head section. Using one tool across platforms also means every site is measured the same way. Each platform's built-in stats count differently, so their numbers can't be fairly compared.

Use one when your business depends on detailed paid-ad attribution or long-term individual customer journeys. In that case, pair it with a properly configured consent banner. Most content sites, small shops and client sites don't need that depth.

Sources