“Cookieless” describes one technical feature. It is not a legal conclusion.
An analytics tool may avoid cookies but still read or write information on a visitor’s device, receive an IP address, create a fingerprint, or send data to another provider. Each fact can change the assessment. The answer also depends on the country whose electronic-communications rules apply.
Run two separate tests
The first test concerns access to the user’s terminal equipment. Article 5(3) of the ePrivacy Directive generally requires clear information and consent before storing information or gaining access to information already stored on a device, except where the operation is strictly necessary for the requested service or solely enables transmission.
This test is broader than cookies. Local storage, advertising identifiers, pixels, and some fingerprinting methods can fall within it.
The second test concerns personal data. If the analytics system processes information relating to an identified or identifiable person, the GDPR applies. You then need a lawful basis, transparency, minimisation, retention limits, appropriate processor terms, security, and a transfer mechanism where relevant. Removing a cookie does not remove those duties.
Inspect the implementation, not the product label
Record the answers to these questions:
- Does the script set or read cookies, local storage, cache identifiers, advertising IDs, or similar device data?
- Does it derive a persistent or probabilistic identifier from browser or device attributes?
- Which fields leave the browser, including full IP address, URL parameters, referrer, user ID, and free text?
- Are identifiers truncated, discarded, or aggregated, and at which point?
- Can the provider or your organisation single out a visitor across visits?
- Where is the service hosted, which subprocessors receive data, and are international transfers involved?
- How long are raw events and aggregates retained?
Use the provider’s current technical documentation and verify it against a network trace. Marketing language such as “privacy-friendly” is not evidence of the deployed configuration.
A decision table
| Finding | Likely next step |
|---|---|
| Non-essential terminal storage or access | Obtain valid consent before it occurs, subject to the applicable national rule |
| Strictly necessary terminal operation only | Document the necessity analysis and provide any required information |
| Personal data is processed | Select and document an Article 6 basis and meet the other GDPR duties |
| Truly anonymous aggregate data only | Record how identifiability was ruled out and keep the configuration under review |
| Vendor or transfer is involved | Review Article 28 terms, subprocessors, location, and Chapter V safeguards |
In Spain, the AEPD’s Guide on the Use of Cookies is a useful national reference. Other countries can implement and enforce the ePrivacy rule differently, so a multi-country site needs a jurisdiction check.
What to publish
If personal data is processed, describe the analytics purpose, fields, basis, provider, recipients, transfers, and retention in the privacy notice. If terminal access requires consent, the preference mechanism should offer a genuine choice before the relevant operation and make withdrawal as easy as acceptance.
Do not add a banner merely to be safe while allowing the script to run before the choice. Equally, do not remove a banner solely because a vendor says “cookieless.”
GDPR.Direct can help draft the privacy and cookie documents. It does not inspect the deployed script, determine which national rule applies, or operate a consent manager. A developer should verify the network behaviour, and a qualified data-protection reviewer should confirm any uncertain classification.
This article is educational information, not legal advice.
