Consentless tracking explained: cookieless analytics without consent banners
Consent banners exist to protect visitors. In practice, they mostly train people to click “accept” without reading a word, just to make the box disappear. The cleanest consent flow, it turns out, is the one that needs no consent at all.
That is the promise of consentless tracking, and one definitional point matters from the start: consentless does not mean tracking people without their permission. It means collecting only data that can never identify a person, so there is legally nothing to consent to. This article explains how that works, why most analytics tools can’t claim it, and what it means for your traffic data.
Why do most analytics tools require user consent?
Before we get into consentless tracking, one question deserves an answer: why do most traditional analytics tools require explicit user consent before collecting data?
The short answer: the data that cookie-based analytics tools collect and process is personal data of website visitors.
Explicit consent, a legal requirement
Cookie-based tracking has existed since the early days of the Internet. Cookies collect data about users, often without them noticing, as they move across the web.
“First-party” cookies allow website owners to analyze traffic and optimize performance. The controversial ones are “third-party” cookies, which continue tracking data across websites and feed the collected information to ad networks and data brokers.
The central concern with that type of tracking is the amount of accumulated data that allows pinpoint user profiling. Even if data brokers don’t have personally identifiable information such as full names, addresses, and social security numbers, we all witness that ad campaigns and social media recommendations can often be surprisingly accurate.
Such accuracy raises concerns about potential privacy infringement.
GDPR-led changes
Many laws regulated the digital ecosystem, such as the ePrivacy Directive, but the EU’s General Data Protection Regulation made the biggest leap on consent and online tracking. Here are the most important changes it introduced for website tracking:
- Explicit personal data processing consent became mandatory, which led to mandatory cookie consent banners.
- Personal data can be collected and processed only for the specific purposes for which the consent was given.
- The amount of personal data collected needs to be the minimal amount required to achieve the purpose.
- Keeping data within the EU is recommended to avoid legal complications, alongside applying strong security measures like encryption.
GDPR also has a broad definition of personal data: any data traced back to an individual physical person is considered personal data, whether on its own or when combined with other information. That means processing IP addresses is regarded as personal data processing, even when IPs are hashed.
Techniques like fingerprinting or profiling, where multiple data points are combined to identify a user, also fall under personal data processing. Even if each data point is harmless on its own, consent is required if the combination allows identification.
GDPR also introduced high penalties for non-compliance, reaching as much as 20 million euros, or up to 4% of a company’s global turnover.
The GDPR’s influence spread rapidly, as any website serving the EU market had to comply. Worldwide lawmakers soon followed, with the California Consumer Privacy Act (CCPA) among the most prominent examples of post-GDPR privacy regulations.
While legislators introduce changes to the approach, the main line of thinking remains the same: personal data processing is only allowed if previous consent has been given.
Consent-based tracking: concerns beyond compliance
While companies can face GDPR fines even if they use cookie banners, legal penalties aren’t the only concern that follows consent-based analytics.
Ethical dilemmas among privacy-aware individuals
Legislators aren’t the only ones responding to tracking on a massive scale. Users are taking matters into their own hands.
Beyond rejecting cookies, users increasingly turn to privacy tools to protect their data:
- Popular ad-block extensions have millions of downloads
- Users switch to private web browsers and search engines that don’t track personal data
- Virtual Private Networks (VPNs) are often used to cloak web traffic
- Major browsers themselves increasingly restrict third-party cookies by default
As a result, traditional cookie-based marketing is no longer as accurate as it used to be.
However, the diminished data accuracy isn’t the central issue. When data-conscious users see consent banners, they know the website asks them to share their data with ad networks and brokers.
Privacy-conscious users may view this approach as misaligned with their expectations. They will likely question the ethics of a brand that shares their data to sharpen its marketing, refuse consent, and look for alternative brands with higher ethical standards.
In other words, relying on cookie-based analytics may cause you to lose potential customers and clients to direct competitors.
UX interruptions and loss of conversions
We often hear that “data is the new oil,” but in today’s digital world, user attention might be even scarcer.
That’s why complicated consent banners that take up significant portions of your pages and interfere with their design can hurt user experience.
Instead of browsing your content and offerings, users are faced with tickboxes and small text. That distraction shapes how they behave once they enter your site and whether they eventually convert.
Banner fatigue, in other words, costs conversions. Ironically, the goal of analytics is to improve conversions, yet consent-based tracking often does the opposite.
A shift toward consentless, privacy-focused tracking
Due to the rising legislative pressure and the growing number of privacy-conscious users, relying solely on consent-based tracking is becoming less sustainable. As a result, businesses started looking into less invasive visitor tracking software.
Privacy-friendly analytics: cookieless doesn’t (always) mean consentless
Third-party cookies raise concerns as they gather user data across websites, often on behalf of major ad networks. In response, more and more cookieless analytics solutions allow website owners to track visitors limited to their own site.
However, cookies aren’t the primary privacy concern on their own. Unnecessary personal data processing is what infringes user privacy the most. If you collect personal data, you are required to ask for consent.
While they don’t rely on third-party cookies to collect data, some privacy friendly analytics tools implement methods such as IP address hashing, assigning unique identifiers, and precise location and device tracking. As a result, even if they don’t use cookies, they still “fingerprint” individual users, which is considered personal data processing.
That means those types of privacy-friendly analytics collect data without cookies, but they still require user consent.
Privacy-first analytics: true consentless tracking
So-called privacy-first analytics goes a step further than privacy-friendly solutions. It avoids processing any personal data altogether.
Instead of cookies, processing IP addresses, hashing, fingerprinting, and similar methods considered personal data collection and processing, privacy-first tools rely on non-invasive tracking.
While these methods aren’t precise enough to track individual users, which is why they aren’t considered personal data processing, they are accurate enough to distinguish individual website visits.
As a result, privacy-first tools don’t require consent banners, leaving the user experience untouched. At the same time, tracking remains reliable: ad blockers, VPNs, or private browsers won’t distort your traffic numbers.
The practical difference is easy to picture. Two online shops launch in the same week. One runs consent-based analytics: industry surveys commonly report that 30 to 50 percent of visitors reject or ignore consent banners, so a meaningful share of its traffic never shows up in the dashboard. The other runs privacy-first analytics and sees accurate visitor numbers from day one, with every visit counted and no banner in sight.
mandera: privacy-first analytics for true consentless tracking
mandera is a privacy-first, agentic website growth system. Its analytics suite measures everything happening on your website without cookies or personal data, and the rest of the system turns that data into growth opportunities, strategies and content.
mandera implements non-invasive tracking methods and removes IP addresses from every request. What it measures instead is a small set of harmless signals:
- the page that was opened
- the traffic source, taken from the referrer or from campaign parameters such as utm_source
- the country, derived from the browser timezone, never from an IP address
- the language, from the browser setting
- screen and window size
- engagement, such as time on page, clicks and scroll depth
- the device, browser and operating system, in shortened form
Because that type of information can’t be traced back to individuals, it isn’t considered personal data. Using mandera analytics doesn’t require consent banners, and the approach is GDPR compliant by design. You can read exactly how this works in our documentation on how we track.
Furthermore, the website UX remains uninterrupted, letting visitors focus on your main content, which supports user satisfaction and conversions.
Additionally, privacy-aware users will appreciate that you are using cookieless tracking solutions to maintain high ethical standards and respect their privacy, which can boost brand reputation.
Measuring traffic is where mandera starts, not where it ends. Everything the analytics suite collects flows into mandera’s Agentic Engine, which surfaces growth opportunities from your own data and helps you turn them into strategies and content, while you approve everything that touches your site.
Frequently asked questions
Is consentless tracking legal in the EU?
Yes, provided the tool genuinely collects no personal data. GDPR’s consent requirements apply to personal data processing, so analytics that only record anonymous, aggregate signals fall outside their scope. The key is that no data point, alone or combined, can be traced back to an individual.
What is the difference between consentless and cookieless?
Cookieless means a tool works without cookies, but it may still process personal data through methods like IP hashing or fingerprinting, which require consent. Consentless goes further and collects no personal data at all. Every consentless tool is cookieless, but not every cookieless tool is consentless.
What data can be collected without consent?
Anything that cannot identify a person, alone or in combination: the page viewed, the referrer, the country derived from the browser timezone, the browser language, screen size, and engagement signals such as scroll depth. Once IP addresses, unique identifiers, or fingerprints enter the mix, the data becomes personal and consent rules apply.
Our conclusion
Consent-based marketing is losing ground because privacy-aware users are growing in number, and worldwide legislation is becoming more stringent. Relying on it increasingly means compliance headaches, ethical dilemmas, and risks to brand reputation and conversions.
Privacy-first tools such as mandera allow you to track website visits accurately without collecting any personal data. This consentless approach helps you stay ahead of changing regulations while earning trust from today’s privacy-aware users.
Ready to see it on your own traffic? Subscribe to mandera and put the whole system to work on your growth. Your free trial includes 10 high-impact opportunities to get you started.
Last updated: 15 June 2026