Almost every website shows a cookie banner these days, and many site owners wonder whether it’s really necessary.
The same question keeps coming up in my own projects and on client websites: do you need a banner just for visitor statistics? When I built Lienks, a simple, privacy-friendly web analytics tool, I had to look into it more closely.
In this article, I explain what matters and how Lienks handles it. I’m not a lawyer, and this isn’t legal advice. If in doubt, have your own website checked.
When do you need consent?
Whether you need consent depends less on the word “cookie” and more on whether something is stored on or read from your visitors’ devices.
In the EU, this is governed by the ePrivacy Directive, specifically Article 5(3). Each country has written it into its own law. In Germany, where I’m based, that’s § 25 TDDDG.
Put simply: if you store information on a visitor’s device or read it from there, you need their consent. That covers cookies, but also the browser’s localStorage. According to the German data protection authorities, it also applies when a script deliberately reads device properties to recognize it again.
There is one exception: if something is strictly necessary to provide a service the visitor has explicitly asked for, no consent is needed. Typical examples are a login or a shopping cart.
Whether visitor statistics fall under this exception isn’t clearly settled, and countries interpret it differently. In France, the data protection authority CNIL allows audience measurement without consent if certain conditions are met. The German authorities write in their guidance (German) that there’s no blanket answer and that each tool and configuration has to be looked at individually.
And even if nothing is stored on the device, you’re not done yet. Because alongside this rule, there’s also the GDPR.
Is it enough to not use cookies?
Not using cookies is a good start, but it isn’t the full answer.
That’s because there are two different rules. The ePrivacy rule from the previous section is about whether something is stored on or read from the device. The GDPR is about how personal data is processed. If you drop cookies, you’ve only dealt with the first one.
Even without cookies, every browser automatically sends its IP address with each page view. An IP address usually counts as personal data, even if it’s only processed briefly. Under the GDPR, that requires a legal basis, such as consent or legitimate interest.
By the way, the authorities don’t fully agree here. In its guidelines, the European Data Protection Board considers it possible that simply collecting the IP address already falls under the device access rule. Whether that view will prevail is still open.
Also, “cookieless” doesn’t automatically mean nothing happens on the device. Some tools use localStorage instead of cookies, or read device properties to recognize it. Then the rule from the previous section applies again. So it’s worth checking what a tool actually does.
You’ll usually still need two things: a note in your privacy policy saying which tool you use and what data it processes. And if an external provider processes the data for you, a data processing agreement (DPA) with them.
On lienks.com, I use Lienks myself in cookieless mode. In my privacy policy, I name legitimate interest as the legal basis: understanding and improving how my website is used. That’s my decision for my website, not a recommendation for yours.
I’ll show how Lienks handles all this in the next section.
How does Lienks count visitors, with and without a cookie?
With Lienks, you decide for each website whether and how visitors are recognized. There are three modes for that.
Minimal only counts page views and events. Lienks doesn’t try to recognize visitors at all. So you see how often a page was viewed, but not how many different people that was.
Cookieless is the default mode. So that I can still see how many different visitors came on a given day, the server creates an identifier from the website, the IP address, and the browser. This uses a secret key that is newly derived every day. The same person therefore gets a different identifier the next day, and on two different websites they have two different identifiers.
Only this identifier is stored. The IP address doesn’t end up in the analytics data. If you enable country tracking, all that’s left of it is the country code, for example “DE”.
In Minimal and Cookieless mode, the Lienks script doesn’t set any cookies and doesn’t use localStorage. It sends the page view to Lienks, nothing more.
Cookie is meant for websites that already have a consent banner anyway. After consent, Lienks sets a cookie with a random ID that expires after 24 hours. Lienks doesn’t come with its own banner. You pass the consent from your banner on to the script. Until that happens, Lienks doesn’t set a cookie and counts the same way as in cookieless mode.
Lienks doesn’t recognize visitors across multiple days in any mode, not even with a cookie. The difference between Cookie and Cookieless is smaller: if someone switches from Wi-Fi to mobile data during the day, their IP address changes. In cookieless mode, Lienks then counts them twice; with a cookie, only once.
Which mode you choose depends on what you want to know:
- Minimal, if page views are enough and you want to process as little data as possible.
- Cookieless, if you also want to know how many different visitors came. For most websites, that’s enough.
- Cookie, if you already have a banner and want to count visitors a bit more precisely within a day.
By the way, Lienks only records country, browser, and device if you turn that on for your website. All data is stored on servers in Germany. I explain in more detail how counting without cookies works on the Cookieless Web Analytics page.
When do you still need a cookie banner?
Even with an analytics tool that doesn’t use cookies, your website may need a banner, for example because of embedded videos, ads, or other services.
The rule from the first section applies to everything running on your website, not just the analytics. Typical examples are:
- embedded YouTube videos or Google Maps
- ad and conversion pixels, for example from Meta or Google Ads
- chat widgets, newsletter pop-ups, or other third-party tools
Many of these services set cookies or store something in the browser as soon as they load. That often requires consent, no matter which analytics tool you use.
And if you want to recognize visitors with a cookie, including Lienks in cookie mode, you’ll need a banner as well.
That’s also why I paid attention to the product video on lienks.com: it’s hosted as a file on my own server instead of being embedded from YouTube.
If you want to know what your own website stores, a quick look at your browser’s developer tools helps. Under “Application” or “Storage” you’ll see cookies and localStorage, and under “Network” you’ll see which external services are loaded.
So: do I need a cookie banner?
I can’t give you a simple yes or no, but you can now judge the question for your own website much better.
For most websites, three questions help:
- Does anything on your website store or read information in your visitors’ browsers? That could be your analytics, but also a video, a map, or an ad pixel.
- Is it strictly necessary for your website to work? For a login or a shopping cart, yes. For analytics, it’s usually not that clear.
- What personal data do you process, and on what basis? Even without cookies, this belongs in your privacy policy.
If you can answer “no” to the first question across the board, you’re already a good deal further. Whether that’s enough for your website is still worth having checked if in doubt. What else you need to do as a website owner is covered on the GDPR-compliant web analytics page.
I built Lienks so that you can make this decision for each website yourself, and so that you know what happens in each mode. If you’d like to try it, you can test Lienks free for 30 days, no payment method required.
And if you have questions or something in this article isn’t right, write to me at philip@lienks.com.