Most posts about cookieless analytics never quote the rule that produces the banner. It decides the answer, so start there.
The banner on your site doesn’t come from GDPR. It comes from Article 5(3) of the ePrivacy Directive, and the wording is narrower than people assume: consent is required for “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user.”
Storing something on the device, or reading something already there. That’s the trigger. Not measuring, not counting, not processing.
Why “It’s Anonymous” Does Not Settle It
The common defence is that the analytics data is anonymous, so no consent is needed. That argument addresses the wrong law.
The EDPB’s 2023 guidelines on the technical scope of Article 5(3) are explicit that the rule covers “both non-personal data and personal data, regardless of how this data was stored and by whom.” Anonymity is irrelevant to whether you stored something on someone’s device. If your tool writes a cookie or a localStorage entry, you are inside Article 5(3) whether or not anyone could be identified from it.
Which cuts the other way too, and this is the part worth understanding. A tool that writes nothing to the device never engages Article 5(3) at all. Not exempt from it, never in scope to begin with.
What Has to Be True of the Tool
So the question becomes mechanical. Does it store anything client-side?
For my own plugin the answer is no, and it is checkable rather than a marketing claim. There is no setcookie call, no document.cookie write, no localStorage and no sessionStorage anywhere in the codebase. The beacon posts and forgets.
Repeat visitors still need distinguishing from new ones, and without a cookie the only material available is the request itself. Vireo hashes the IP and user agent together with a salt that rotates every twenty-four hours, keeps the previous day’s salt for one extra day so visits that straddle midnight still reconcile, and stores the result. The entire visitor table is two columns: a date and a 32-character hash. The raw IP never survives the request.
The daily rotation is what stops that hash being a persistent identifier. Yesterday’s hash for a given person and today’s do not match, which is also why a tool built this way genuinely cannot tell you how many unique people visited this month, which also shapes what you give up leaving GA. That limit is the privacy property, not a gap in the feature list.
GDPR Is a Separate Question
Clearing Article 5(3) does not mean you are done, and any plugin page implying otherwise is overselling.
An IP address is personal data under GDPR, and Vireo handles one on every request even though it never writes one down. That processing needs a lawful basis. For first-party analytics that basis is usually legitimate interest rather than consent, which is a different test with different obligations: a balancing assessment, a privacy notice that actually describes what happens, and a route for people to object.
Two different laws, two different questions. Most of the confusion in this area comes from answering one and assuming it covers the other.
The Rules Diverge by Country
ePrivacy is a directive, not a regulation, which means each member state implemented it in its own law and each regulator reads it its own way. There is no single European answer to give you.
France’s CNIL, for instance, runs a specific exemption for audience measurement, updated in July 2025 with a self-assessment tool. It comes with cumulative conditions: first-party only, no cross-site tracking, data not shared with third parties, purposes limited to measuring and improving the site, and defined retention limits. Meet all of them and the tracker is exempt in France. That exemption is French. It does not travel.
Your Analytics Is Rarely the Only Thing Setting Cookies
Here is where the practical answer usually dies. You swap to a cookieless analytics tool, go to remove the banner, and discover that the embedded YouTube video sets cookies, the Google Fonts request reaches a third party, the map widget stores a session, or the chat bubble drops an identifier the moment the page loads.
Analytics is often the most visible tracker on a WordPress site, and not always measuring what you think and rarely the only one. Removing it changes your obligations only if nothing else on the page is doing the same thing.
WordPress itself is on that list. Load a stock install with a cookieless analytics plugin and nothing else, open the console, and you will find a wpEmojiSettingsSupports entry sitting in sessionStorage. Core writes it to remember whether the browser can render emoji, and it is storing information on terminal equipment by any reading of the words. Whether it falls under the strictly-necessary carve-out is a fair argument to have, and it is an argument, which is the point.
Open the storage panel, look at what is actually there, and count what you find before you touch the banner.
What I Am Not Telling You
Whether you can remove your banner depends on your jurisdiction, your regulator’s published position, and everything else running on your pages. I build analytics software, I am not a lawyer, and an article cannot do that analysis for your site.
What I can tell you is the mechanical half, because that one is checkable. A tool that writes nothing to the device is outside the rule that produces banners. Whether your site as a whole is outside it is a different question, and usually a longer one.
Vireo Analytics is free on the WordPress plugin directory, and honours DNT: 1 and Sec-GPC: 1 by default regardless of any of the above.
Related
Leave a Reply