The short answer
If you genuinely store nothing on the visitor's device and process no personal data for tracking purposes, you generally do not need a consent banner. But "we do not use cookies" is a claim that fails on inspection more often than it holds.
Why the rule is not about cookies
The relevant provision of the ePrivacy Directive covers storing information, or gaining access to information already stored, on a user's terminal equipment. Cookies are the best known example, not the definition. The same rule reaches:
- localStorage and sessionStorage
- IndexedDB
- Cache-based storage techniques
- Device fingerprinting, which reads information from the device rather than writing it
- Pixels and beacons that read or set identifiers
A site that replaced cookies with localStorage identifiers has not changed its legal position. It has changed its wording.
What genuinely cookieless analytics looks like
A tool that avoids the consent requirement for analytics purposes typically:
- Sets nothing on the device — no cookie, no localStorage entry
- Does not build a persistent identifier for an individual across visits
- Does not fingerprint the browser
- Handles the IP address transiently, without storing it, and uses it only for coarse geolocation and bot filtering
- Counts a return visit statistically rather than by recognising the individual
The trade-off is real: without a persistent identifier you cannot follow one person across weeks. What you get instead is aggregate truth — how many, from where, to which pages — which is what most site owners were using anyway.
The things that catch people out
You may have removed your own cookies while third parties keep setting theirs. Audit these specifically:
- Embedded video. The standard embed of a major video platform sets cookies. Privacy-enhanced embed modes exist and are worth using.
- Web fonts loaded from a third party. No cookie in some cases, but the request itself transmits the visitor's IP address to another company — a point that has been the subject of enforcement in Europe. Self-hosting fonts removes it.
- Maps, chat widgets, comment systems, social share buttons. Almost all of them store something.
- Your own A/B testing or feature flag tool.
- A CDN or firewall security cookie. Often genuinely necessary, but worth being able to explain.
What you still need without a banner
Dropping the banner does not drop the transparency obligation. You still need a privacy policy that explains what data is processed, why, on what legal basis, for how long and with whom it is shared. Aggregate analytics data still deserves a paragraph, even if it involves no personal data — being able to say clearly "we count page views without identifying you" is worth more than a banner.
How to verify your own claim
1. Open the site in a private window with developer tools on the storage panel.
2. Load a few pages, interact normally, and check every storage type — not just cookies.
3. Open the network panel and look at every third-party domain contacted.
4. For each one, ask what information about the visitor it receives.
If that audit is clean, you can say "cookieless" and mean it. If it is not, fix what it found before removing anything.
As always, this is general information rather than legal advice.