Analytics without a cookie banner: what is actually allowed

Audience measurement is not strictly necessary to deliver a web page, so under the ePrivacy rules it needs consent, like any other tracker, unless a national rule says otherwise. France has such a rule: the CNIL exempts audience measurement from consent when the tool is used only to measure the audience of the site for its publisher, produces anonymous statistics only, does not cross-reference the data with other processing and does not track the visitor across sites or apps. Matomo in its CNIL mode, Plausible and Fathom are built to fit those conditions. Google Analytics 4 is not, and needs consent.

The rule and the exemption

Article 5(3) of the ePrivacy Directive allows storing or reading information on a device without consent only when it is strictly necessary to provide a service the user explicitly requested. Counting visitors does not qualify, which is why analytics sits behind the banner almost everywhere.

The CNIL's position, based on article 82 of the French Data Protection Act, is that certain audience measurement trackers can be exempt because they serve the publisher's legitimate need to run the site, provided they stay within strict limits. On its guidance page (updated 4 July 2025) the trackers must:

• be used for a purpose strictly limited to measuring the audience of the site or app, for the publisher only;
• serve only to produce anonymous statistics;
• not lead to cross-referencing with other processing (customer files, other sites' statistics);
• not allow the global tracking of a person's browsing across different sites or apps.

The CNIL also recommends informing users (in the privacy policy, for instance), limiting the tracker's lifetime to what allows comparison over time, such as thirteen months, without automatic renewal at each visit, keeping the collected data for twenty-five months at most, and reviewing those durations periodically. It publishes a self-assessment tool for vendors of audience measurement solutions. A vendor that meets the criteria may say its solution can be implemented without consent when correctly configured; it may not say it is "certified" or "validated by the CNIL". The burden stays with the publisher.

In the UK, the ICO's guidance now describes a "statistical purposes" exception: the sole purpose must be to collect statistical information about how the service is used, users must get clear information and a simple, free means to object, and the data may only be shared with a third party that helps improve the service, which must be a processor rather than a joint controller. Elsewhere in Europe there is no published equivalent, and "cookieless" does not automatically mean "exempt": the rule covers any access to the device, and a hashed identifier computed from the IP address and browser is still processing of personal data under the GDPR. Check your own authority's position before removing the banner for analytics.

Tools that can fit the conditions

Matomo (self-hosted or cloud). Matomo documents a CNIL compliance mode. Turning it on sets IP anonymisation to at least two bytes, disables the visits log and visitor profiles, disables user ID collection, turns off third-party cookies and cross-domain tracking, caps tracker lifetime at thirteen months without extension, sets retention to 759 days (about 25 months), restricts e-commerce reports, disables cohorts, heatmaps, session recordings and A/B tests, and discards campaign parameters. Publishers must still embed an opt-out themselves. Matomo's own wording is careful: the assessment only concerns whether the tool can run without prior consent, not overall compliance.

Plausible. Plausible's data policy states that it uses no cookies, browser cache or local storage and generates no persistent identifiers. Visitors are counted through a hash of a daily salt, the site domain, the IP address and the user agent; the salt is rotated and deleted every 24 hours, and raw IP addresses and user agents are never stored. Plausible says that with its tool you do not need a cookie banner for analytics. That is the vendor's assessment; the configuration described matches the CNIL conditions on its face.

Fathom. Fathom's privacy policy says it uses no cookies and does not collect personal data that would trigger the consent requirement under the ePrivacy Directive. The same policy acknowledges that IP addresses and user agents are personal data under the GDPR and that the lawful basis is usually consent or legitimate interest. Fathom's reasoning rests on the view that an IP address supplied by the network is not information stored on the device.

Umami, Simple Analytics and others make similar designs. Whatever the tool, the exemption attaches to the configuration and the use, not to the brand: the moment you connect the statistics to a CRM, run marketing attribution or share non-anonymous data with a third party, you are outside it.

Why Google Analytics 4 does not qualify

GA4 sends each hit to Google, which processes it under its own terms, links it with Google Ads and Google signals when enabled, and uses cookies (_ga, _ga_*) with a two-year lifetime by default. That fails the "publisher only", "no cross-referencing" and "no cross-site tracking" conditions regardless of IP anonymisation. Google's own EU user consent policy requires sites to obtain consent for cookies where legally required and for personal data used for ads personalisation for users in the EEA, the UK and Switzerland, and to keep records of that consent. In February 2022 the CNIL also ordered a French website operator to stop using Google Analytics over transfers of data to the United States; the European Commission's adequacy decision of July 2023 for the EU-US Data Privacy Framework has since changed the transfer analysis for certified companies, but it did not change the consent analysis. GA4 belongs in the analytics category of your banner, with Consent Mode sending the signals; see the Consent Mode guide.

A practical setup

1. Decide what you need from analytics. Page views, referrers, countries and devices are covered by the exempt tools. Funnels tied to individual users, user IDs, remarketing audiences and cross-domain journeys are not.
2. Pick the tool and apply the exempt configuration; for Matomo, the compliance mode plus the opt-out; for Plausible or Fathom, the default.
3. Fill in the CNIL self-assessment for your own records, and describe the tool in the privacy policy with its purpose, the thirteen-month and twenty-five-month limits, and the opt-out.
4. If you also use marketing tags or embeds, you still need the banner for those. The exempt analytics script does not need to be marked for consent; leave it unmarked so it runs for everyone, and list it in the cookie policy as exempt audience measurement. Cookiequiet's scanner recognises Matomo, Plausible, Fathom and Umami and lists them with their category, which you can set to necessary for an exempt configuration.
5. If you operate outside France, document the position of your own authority before you rely on the exemption, or keep analytics behind the banner.

The honest summary

Consent-free analytics exists, is legal in France when configured to the letter, and gives you counts for every visitor instead of the 60 percent who accept. It costs you user-level analysis and attribution, and it does not exempt anything else on the page. For most content sites, that trade is worth making. For sites that live on advertising and remarketing, the banner stays, and the question becomes what consent rate to expect.