Does GDPR require a cookie banner for analytics?

Only if the analytics tool sets cookies or stores personal data. A cookieless tool that stores no personal data falls outside the consent requirement, so no banner is needed.

What is a DPA and do I need one for analytics?

A Data Processing Agreement (DPA) is the Article 28 contract between you (the controller) and your analytics provider (the processor). You need one for any processor that handles visitor data on your behalf.

Is cookieless analytics enough to be GDPR compliant?

It covers the biggest obligations (no consent banner, minimal personal data). You still need a DPA in place, a lawful basis, transparency (a privacy policy), and EU data residency.

How are data subject requests handled with cookieless analytics?

Because no personal data is stored (no cookies, no IP, only a daily-rotating hash), there is no personal data to return or erase in response to a subject access or erasure request.

Blog

GDPR-compliant analytics: what to look for

A practical checklist for choosing a GDPR-compliant analytics tool. Six things to check before you embed the script.

Published August 2026

The two questions GDPR asks of your analytics

The GDPR applies to any tool that processes personal data on behalf of your business. For analytics, two questions decide how heavy the obligations are:

Does it set cookies or store identifiers? If yes, the ePrivacy Directive requires consent before the script loads, which means a cookie banner and a consent management platform.
Does it store personal data, like IP addresses? If yes, the full GDPR applies: lawful basis, transparency, data-subject rights, retention limits, and a Data Processing Agreement.

A cookieless tool that stores no personal data answers both questions with "no." The consent requirement falls away, the lawful-basis question simplifies, and the privacy risk to your visitors is close to zero. You still need a DPA, but the underlying processing is minimal.

The core idea. The cleanest way to be GDPR compliant is to not process personal data in the first place. Everything in this checklist follows from that principle.

The checklist: six things to look for

1. No cookies, no consent banner

If the tool sets cookies, you need a banner and valid opt-in before it loads. A cookieless tool needs neither. This is the single biggest compliance simplification, and it is the first thing to check.

2. No IP addresses stored

The IP address is personal data under the GDPR. A compliant tool should hash it with a rotating salt and discard the original, never store it in a raw column.

3. EU data residency

Visitor data should be processed and stored in the EU, with no US edge or CDN provider in the path. Data hosted outside the EU is subject to foreign surveillance laws and requires Standard Contractual Clauses.

4. A signed DPA (Article 28)

Your analytics provider is a processor. You need a signed DPA in place. A vendor confident in its compliance makes the DPA downloadable.

5. A public subprocessor list

The provider should publish who processes data on its behalf, where they are, and what they touch.

6. Retention limits and deletion

Data should not be kept forever. Look for configurable retention and the ability to delete a site’s data on request.

How MetriXs meets each point

GDPR requirement	How MetriXs handles it
Lawful basis	Legitimate interest; minimal processing, no personal data stored
Consent (ePrivacy)	Not required, no cookies or local storage are set
Data minimisation	Only a daily-salted hash is stored; raw IP is discarded
Storage limitation	Retention set by plan (1 month to 2 years); auto-deletion after
Data residency	Hosted in Germany, no data leaves the EU
Article 28 DPA	Signed DPA available for download
Subprocessors	Public list: Hetzner, Mollie, Lettermint, MaxMind (local)
Subject rights	No personal data stored; the hash cannot be traced to a person

"GDPR-compliant" with cookies is not the same

Many analytics tools market themselves as GDPR compliant while still setting cookies. They are compliant only if you deploy a consent banner, get valid opt-in before the script loads, honour rejections, and maintain a record of consent. That is a configuration and legal burden on every page, and a rejected visitor is invisible to your numbers.

A cookieless tool removes that entire surface. Compliance is a property of the architecture, not a task on your checklist.

Frequently asked questions

Does GDPR require a cookie banner for analytics?: Only if the analytics tool sets cookies or stores personal data. A cookieless tool that stores no personal data falls outside the consent requirement, so no banner is needed.
What is a DPA and do I need one for analytics?: A Data Processing Agreement (DPA) is the Article 28 contract between you (the controller) and your analytics provider (the processor). You need one for any processor that handles visitor data on your behalf.
Is cookieless analytics enough to be GDPR compliant?: It covers the biggest obligations (no consent banner, minimal personal data). You still need a DPA in place, a lawful basis, transparency (a privacy policy), and EU data residency.
How are data subject requests handled with cookieless analytics?: Because no personal data is stored (no cookies, no IP, only a daily-rotating hash), there is no personal data to return or erase in response to a subject access or erasure request.

Compliance you do not maintain

Cookieless, EU-hosted, with a signed DPA. Free plan, paid from €6/month.

Start free trial →