Why a Cookie Banner Is Often Unnecessary

A cookie banner is only mandatory when you store or read information on your visitors' devices that isn't strictly necessary for the service they requested: pure, aggregated statistics without any personal identifier — say "342 page views today" instead of "user X clicked at 2:03pm" — often don't fall under the consent requirement of Art. 5(3) of the ePrivacy Directive at all. For you as a business owner, that means the banner isn't automatic — it's the consequence of a specific technical choice.

What actually triggers the cookie banner requirement

The consent requirement is triggered by storing or reading information on a user's device that isn't technically necessary for the requested service — that's the core of Art. 5(3) of the ePrivacy Directive, implemented in national telecoms/data-protection law. A classic third-party tracking cookie that follows you as a recognisable person across different websites for weeks is the textbook case. A count that only answers "how many" rather than "who", and that doesn't allow re-identification afterwards, is something fundamentally different.

When you genuinely don't need a banner

You genuinely don't need a banner when your statistics meet three conditions at once: no cookie or comparable persistent storage on the device, no combination with an IP address into a recognisable profile, and no sharing with third parties who could build a profile from it. That's exactly why btlabs Core has relied on cookieless, aggregated analytics from the start instead of a third-party analytics tool retrofitted to be "privacy-friendly": 100% data sovereignty here also means that, as the operator, you never even end up with a borderline case you might misjudge. To see what that looks like in practice, take a look at our own privacy policy — it manages without a banner.

The guidelines that clarified the matter in 2024

The European Data Protection Board's (EDPB) Guidelines 2/2023, finally adopted in October 2024, clarified that Art. 5(3) reaches considerably further than classic cookies. Pixel tracking, URL-based identifiers, local processing and even certain forms of device fingerprinting can meet the same legal criteria as a cookie, because what matters is the technical act of accessing information on a device — not whether the word "cookie" is literally involved. For your decision, that means concretely: no cookies doesn't automatically mean no ePrivacy obligation. Anyone who only checks whether a cookie-banner tool is in use is checking the wrong question — what matters is what actually happens technically on the device.

What this means for your budget and your legal risk

For your project budget and your legal risk, this cuts both ways: an unnecessary banner measurably costs you conversions — every extra click before the actual content is a drop-off point, and a banner you don't need is pure friction with no upside. A missing banner where one is actually required, on the other hand, is a real cease-and-desist risk that gets more expensive over the years than any design debate. So the real decision isn't a matter of taste — it's a technical one: which tools do you use, and what do they actually store on your visitors' devices? And how differently website systems perform on exactly this point is shown in the direct comparison.

How to assess your own case

Three questions get you to a first assessment within minutes: Do you use analytics, marketing or chat tools that use cookies, pixels or similar identifiers? Is there any combination with IP addresses or device characteristics into a recognisable profile? And do you share data with third parties who could build profiles of their own? If the answer to any of these is yes, you generally need a banner — and if in doubt, don't go with a gut call; bring in a lawyer specialising in data-protection law, especially when several tools are combined. This article doesn't replace legal advice — it lays out the technical logic behind it.

A typical real-world case: a business uses cookieless statistics for its own website, but also has an embedded video from a major platform or a chat widget from an external provider — and suddenly the case looks different again, because that second tool sets its own cookies. Cookieless statistics alone, in other words, don't automatically make you banner-free — they're just one building block among several. Going through your entire toolset carefully, instead of only looking at the most obvious piece, gets you to the more solid decision in the end — and saves you both unnecessary friction for visitors and a risk that only shows up years later. If you want to go through your own setup with us, get in touch.