Possibly not — and the test is simpler than most people expect.
Almost everyone assumes the question is do we collect personal data? It is not. There is one rule that decides it, and once you know the rule you can work out your own answer in about five minutes.
The rule, in one sentence
If something on your page stores information on the visitor's device, or reads information already there, you need consent — unless it is strictly necessary for something the visitor actually asked for.
That's Article 5(3) of the ePrivacy Directive, which every EU country implements separately and which the UK has as PECR. Three things about it catch people out.
It doesn't say "cookies". It says information stored on or read from
the device. A cookie is one way. localStorage is another. So is IndexedDB,
so is a cache probe, so is a device fingerprint. Calling your tool "cookieless" doesn't
get you out of it if it still writes something.
It applies even when the data isn't personal. Store a completely random, meaningless string on someone's device and you've triggered the rule. The trigger is the act of writing, not the sensitivity of what was written.
"Strictly necessary" means necessary to the visitor, not to you. A shopping basket that survives a page change is necessary — they asked for the basket. Knowing which blog post performs best is necessary to you. No regulator has ever accepted analytics under this exemption.
The flowchart
A decision flowchart. Start: does anything on the page write to or read from the visitor's device? If no, no banner is needed for that script. If yes, ask whether it is strictly necessary for something the visitor requested. If yes, no consent is needed. If no, consent is required before it runs, and refusing must be as easy as accepting.
Run it over your own page
This is the part people skip, and it's why so many sites swap their analytics, remove the banner, and are still non-compliant. You have to check every script, not just the one you were thinking about.
A table of common scripts on a website and whether each one typically requires consent. Google Analytics, advertising pixels, embedded YouTube videos in standard mode, chat widgets, A/B testing tools and tag managers with marketing tags all typically require consent. Session cookies, the consent record itself, load balancer cookies and cookieless analytics that write nothing typically do not.
Go through your own pages with the network tab open and the application tab next to it. Load the page in a private window, don't touch anything, and look at what has already been written. Most people are surprised by at least one thing.
What a banner costs you
Nobody puts numbers on this, so here are the three places it costs you.
You lose people at the door. An interruption before the content loses some people outright. They came from a search result, met a dialogue box, and went back.
You stop being able to count them. Everyone who refuses, or who closes the banner without choosing, is invisible to your analytics afterwards. Your numbers are now a sample of the agreeable, and the gap between what happened and what you can see is wider than the number in front of you suggests.
It says something about you. A banner is a public statement that your site does something to people that needs permission. Most visitors don't read it, but the ones who do are often the ones evaluating whether to buy from you.
The second cost compounds the first: you lose visitors, and you lose the ability to see that you lost them.
What it takes to drop it
You need every script on the page to pass the flowchart. In practice that means:
- Analytics that writes nothing to the device. That's us — nothing stored, no IP address kept, and counting still works.
- Embedded videos switched to their no-cookie mode, or a click-to-load placeholder.
- Fonts served from your own domain rather than a third party.
- Maps, chat and A/B tools either removed or behind a click.
- Advertising pixels gone. There is no polite version of this one — if you retarget, you need consent, and that is the end of it.
That last one is the honest catch. If your business runs on retargeting you are keeping a banner whatever analytics you pick. The good news is that it can become a much smaller one — a banner about the ads alone is an easier ask than the all-purpose version most sites show, and more people say yes to it.
The short version
- The test is "does it write to the device", and you run it on every script on the page, not just your analytics.
- Strictly necessary means necessary to the visitor. Analytics never qualifies.
- If you keep the banner, make refusing as easy as accepting. That part is not optional and it is the part most often got wrong.
- Removing the banner is an all-or-nothing job. One retargeting pixel puts it back.
If you want the legal reasoning rather than the decision — the articles, the recitals, what regulators have actually ruled, and where the 2022 Google Analytics decisions stand now — that's in what makes web analytics GDPR-compliant.