Privacy and the law

Removing the cookie banner, and what is actually keeping it there

Swapping your analytics and leaving the rest in place is how people do a week of work and still have a banner. Start with an inventory.

The banner is not caused by analytics. It is caused by storing something on a visitor's device, or collecting something that identifies them, and analytics is only one of the things on most sites doing that. Swapping your analytics and leaving the rest in place is how people do a week of work and still have a banner.

Start with an inventory, not with a tool

Open your own site with the developer tools open and look at what is set before anybody agrees to anything. On a typical site the list is longer than expected, and it is usually some combination of these:

  • Analytics — the one everybody thinks of first, and often the easiest to replace.
  • Embedded video — a single embed from a large platform commonly sets more than your analytics did.
  • Chat and support widgets — these almost always store an identifier, because that is how a conversation survives a page change.
  • Advertising and remarketing tags — the hardest to remove, because removing them has a direct cost you can measure.
  • Fonts, maps and social buttons — small, forgotten, and still a third party receiving a request.

Each one is a separate decision. Four of the five can go and the banner stays, which is why the inventory comes first: it tells you whether this is an afternoon or a project.

What replacing the analytics actually buys

If analytics is on the list, replacing it with something that stores nothing removes one cause and, more usefully, removes it permanently. Our script sets no cookie and keeps exactly two values in localStorage — an opt-out and a self-exclusion — both of which exist because somebody asked for them rather than to recognise anybody.

The thing to check in any tool claiming to be cookieless is whether it still builds a durable identifier by another route. Setting no cookie and fingerprinting the browser instead is a change of mechanism, not of substance, and it is common enough to be worth asking about directly.

The order that gets it done

Remove the easy third parties first — fonts you can self-host, social buttons nobody clicks, maps on a contact page that could be a link. Then analytics, which is usually the largest single win for the least lost function. Then the genuinely hard ones, which are the advertising tags, and that is a commercial decision rather than a technical one.

When the list is empty the banner goes with it. Not hidden, not set to auto-accept — gone, because there is nothing left for it to ask about.

What removing it does not do

Three things survive the banner going away, and it is better to know them now than to discover them during a question you cannot answer.

  • Your server logs still exist. Almost every web server writes the visitor's IP address to a file by default, and that file is personal data sitting on your infrastructure whatever your analytics does. Check the retention on it; the common setting is "forever by accident".
  • Your hosting provider still sees the traffic. Removing third parties from the page does not remove the one serving it. That is usually fine and entirely normal, but it belongs in your privacy notice rather than being left out because it felt obvious.
  • You still owe people an explanation. Collecting less does not mean saying nothing. A short, specific page describing what you do collect is worth more to a visitor than a long one about cookies you no longer set.

None of those require a banner. All three are the kind of thing an auditor asks about and a site owner has never checked, which is why they are worth half an hour while you have the subject open.

Whether your particular site needs one at all is a question about what you collect and where your visitors are, and do you need a cookie banner walks through it. For the compliance side, what makes analytics GDPR-compliant has the detail. The product side is cookieless analytics, which is this one.

Common questions

Does switching analytics remove the banner on its own?

Only if analytics was the one thing forcing it. Most banners are forced by several things at once — an embedded video, a chat widget, a remarketing tag — and removing one of four leaves you with a banner and one fewer feature. Inventory first, then decide, or you will do the work and see no change.

What about the cookies my own site sets?

A cookie you set to keep somebody signed in, or to remember what is in their basket, is doing a job they asked for. Those are generally treated differently from ones that exist to build a profile. The distinction is about purpose rather than about the word "cookie", which is why an inventory by purpose is the useful exercise.

Is localStorage a loophole?

No, and treating it as one is the commonest mistake in this area. Rules about storing and reading things on somebody’s device are generally written about the access, not about the API — swapping a cookie for localStorage, an ETag or a cache trick changes the implementation and not the obligation. If a technique exists to recognise the same person tomorrow, assume it counts.

Can I keep the banner and ignore it?

You can, and plenty of sites do, but it costs you twice. Visitors who decline are invisible to your analytics, so your numbers describe the subset who agreed rather than your audience; and a banner is friction on every first visit. Removing the need for one is worth more than making one prettier.

All writing

Read next

Measuring without cookies

Ready

Paste one line. Watch the first visitor arrive.

A 1270-byte script, no cookie banner, and a dashboard that fits on one screen. 30 days on the plan you pick. A card is taken up front and charged when the trial ends, unless you cancel first.