A website without a cookie banner: is it possible, and what do you give up?
A cookie banner is not required. What is required is consent for certain access to the device. Avoid that access and you need no banner — and give up less than most people assume.
In short
- Consent is required for storing and reading information on the device where that is not strictly necessary for the service — not for "cookies" as such.
- Do without the services that require it and you can run with no banner. Server-side analysis remains possible within limits.
- What you mainly give up: recognising visitors across visits, advertising audiences, and embedded third-party content.
- A banner with a high rejection rate produces distorted data anyway — the consent-free route is then often the more honest measurement.
What is actually required
The term "cookie banner" misleads. What is regulated is not the cookie but access to the device: storing or reading information there requires consent unless it is strictly necessary to provide a service the user explicitly requested.
Two things follow from that:
- Other storage mechanisms are covered too — local browser storage, device characteristics used for recognition. A "cookie-free" tool is not automatically consent-free.
- Necessary functions need no consent — login, shopping basket, language preference, abuse protection.
In addition: even without a consent requirement, processing personal data remains tied to a lawful basis and to transparency. No banner does not mean no privacy notice.
What is possible in each case
| Analysis | Without consent | With consent |
|---|---|---|
| Page views per page | yes | yes |
| Referral source | yes | yes |
| Queries from Search Console | yes | yes |
| Rough region | yes, limited | yes |
| Form submissions | yes | yes |
| Recognition across visits | no | yes |
| Attributing ads to closes | limited | yes |
| Advertising audiences and retargeting | no | yes |
| Embedded third-party videos and maps | no | yes |
Worth knowing
A consent banner does not solve the data problem, it moves it. If a substantial share of visitors declines, their data is missing entirely — and the remaining numbers describe a slice that differs systematically from the whole.
A consent-free, coarser measurement captures all visitors equally. For the question "which pages get read and where do people come from", it is therefore often more informative than a finer measurement over a distorted subset. Fewer attributes across everyone beats many attributes across an unknown slice.
A consent-free setup
- Analysis without device access. Server logs, or a tool that works without storing anything on the device — verified, not merely advertised.
- Serve fonts and scripts yourself. No embedding from third-party delivery networks.
- Do not embed videos and maps. Use a preview image with a link that opens in a new window instead.
- No advertising tracking. Ad performance gets measured through landing pages and form submissions rather than device-based recognition.
- Name the necessary functions. What gets stored and why belongs transparently in the privacy notice.
The biggest practical loss is not the analytics but attributing paid advertising to closes. Anyone advertising through search ads or social networks loses a substantial part of the performance measurement without consent — and with it the basis for allocating budget sensibly.
From that follows a simple decision rule: anyone running meaningful paid advertising needs consent. Anyone growing through written pieces, referrals and search engines loses practically nothing and saves themselves the banner.
When doing without is worth it
Worth it
Written pieces, referrals and search engines as the main channels. Few forms. No or a very small advertising budget. An audience with high sensitivity to data protection — in health, legal or financial fields, for instance.
Not worth it
Meaningful paid advertising, a shop with basket analysis, audiences for retargeting, or an existing reporting system built on cross-visit recognition.
The middle way
Basic consent-free measurement for all visitors, plus a banner only on the pages where services requiring consent run — the shop area, for instance. More work, but clean.
What does not work
A banner offering only "accept", or where declining takes more clicks than agreeing. A banner that loads services before the decision is made also fails its purpose.
Check whether our website could run without a consent banner. Our situation: - Services and scripts running on the site: [list, as complete as possible] - Embedded third-party content: [videos, maps, fonts, chat, reviews] - Do we run paid advertising? [yes / no / scale] - Do we have a shop or a login? [yes / no] - What we actually use from the analytics: [list of the numbers we base decisions on] Tasks: 1. Classify each named service: strictly necessary / requires consent / unclear. For "unclear", say which detail is missing. 2. For each service requiring consent, name an alternative that works without device access – or say there is none. 3. Using my list of numbers actually used, work out what we would genuinely lose without consent. Be specific. 4. Give a recommendation: no banner at all, a banner on certain pages only, or a banner as before. Justify it. 5. Name what has to appear in the privacy notice even without a banner. Do not invent statutory provisions. Mark what a legal professional has to assess.
In closing
Working without a banner is possible and, for many small companies, the better choice — above all for those growing through content and referrals rather than paid advertising.
What you give up is cross-visit recognition and fine-grained ad attribution. What you gain is a measurement across all visitors rather than a distorted slice — and a site that starts without a hurdle.
Common questions
Is a cookie banner mandatory?
No. What is mandatory is consent for storing or reading information on the device where that is not strictly necessary for the requested service. Avoid such access and you need no banner — though the privacy notice and a lawful basis for processing remain necessary in any case.
What analysis is possible without consent?
Page views per page, referral sources, queries from Search Console, a rough region, and form submissions. Not possible are recognising the same person across several visits, advertising audiences and retargeting, and embedded third-party content.
What do you lose most without a banner?
Attributing paid advertising to closes. Anyone running meaningful search or social ads loses the basis for allocating budget sensibly. Anyone growing through written pieces, referrals and search engines loses practically nothing.
Is a cookie-free analytics tool automatically consent-free?
No. What is regulated is access to the device as a whole, not just the cookie — local browser storage and the evaluation of device characteristics for recognition are covered too. What a tool actually does has to be verified rather than taken from its product description.
Is data with a banner more accurate?
Not necessarily. If a substantial share of visitors declines, their data is missing entirely, and the remainder describes a slice that differs systematically from the whole. A coarser measurement across all visitors is often more informative for the question of which pages get read and where people come from.
Marketing that sets itself up
The Studio Engine beta is live. Claim your spot and help shape it from the start.
Join the beta →