When analytics needs no consent and the cookie banner goes
What decides is not the word cookie but what a tool stores in the visitor’s device and reads back from it.
Do you consent to the processing of your data?
Cookie banners annoying you? Your visitors feel the same - try analytics without them.
A mock cookie banner. The accept button leads to one more question and keeps doing that forever. The reject button dodges the cursor and cannot be clicked, while refusing has to be as simple as consenting.The answer, by what your tool does
- It stores a cookie, or anything else, in the browserGoogle Analytics, ad pixels, most chat widgets and embedded videos.Consent required
- It stores nothing but builds a browser fingerprintScreen size, font list, graphics card. A fingerprint cannot even be deleted.Consent required
- It stores nothing and only measures traffic on your siteDatrika, for oneIt has to meet all five conditions below, not some of them.No consent needed
What the law says
Anyone who intends to use or uses electronic communications networks to store data, or to gain access to data stored in the terminal equipment of subscribers or users, shall obtain from them demonstrable prior consent covering the scope and purpose of the processing.
The word cookie is not in that sentence. What counts is what gets written to the device and read back from it.
- A cookie is only the best-known way of doing that.
These conditions also apply to other forms of storing data in visitors' technical equipment (cookie-like technologies such as local storage objects, locally shared objects and others), including digital browser fingerprints.
The same rule covers local storage and browser fingerprints.
- A fingerprint is in a worse position than a cookie. It cannot be deleted.
- EDPB Guidelines 2/2023 of 16 October 2024 reach the same conclusion, and add tracking pixels and links.
The five conditions that make measurement necessary
| Condition | What it means in practice |
|---|---|
| Serves solely to measure traffic on the site | The tool must not build advertising audiences or remarketing lists on the side. |
| Does not allow overall tracking of a person across the web | It must not link one person’s visits across days or across sites. |
| Produces anonymous statistical data only | The output is aggregates, not profiles of individual people. |
| Collected data is not combined with other processing | Analytics must not be joined to your customer database. |
| Data is not disclosed to third parties | No sharing with ad networks and no passing it on. |
They are not on the website of the Czech office. The law firm eLegal published their wording on 7 July 2025 as the answer the office gave it.
The office adds that this is no blank cheque and every case is assessed on its own.
Its public page puts traffic-measurement cookies among the non-technical ones. Not a contradiction: that page is about cookies, things that go into the device.
Consent under the act, legal basis under the GDPR
This is the pair people mix up most often. Two layers, and both apply.
May you put something into the device, or read it back?
- Non-technical cookies only with consent.
- Local storage and browser fingerprints likewise.
- A tool that stores nothing never reaches this layer.
Which personal data do you then process, and on what basis?
- Consent is one of six legal bases.
- Legitimate interest or a contract can serve instead.
- Without layer 1, you never get to process anything at all.
An example of legitimate interest is the processing of personal data for the purposes of first-party analytics.
The first layer never arises for us. Nothing goes into the device.
- On the second, most sites rely on legitimate interest, because we keep neither IP addresses nor an identifier that survives the day. The detail is on how we handle GDPR.
What Datrika reads from the browser
Claiming we read nothing would be untrue. Here is all of it:
| What we read | What we keep |
|---|---|
| Screen width | A bucket, for example Full HD or HD. Never the exact number. |
| Browser language | The first part of the code. cs-CZ becomes cs. |
| Where you came from | The source of the visit. |
| The page address | The address without parameters, except five utm_ tags. |
| IP address and user-agent header | Country, region, city, browser and device. The IP address is then dropped. |
We read from the browser. We write nothing back into it.
- The identifier is built from the truncated IP address, the user-agent header and your site id.
- Neither screen width nor language goes into it.
- The exact list of fields is on the what we store page.
How our design maps onto the conditions
| Condition | Datrika |
|---|---|
| Traffic measurement only | Analytics is our only product. We build no advertising audiences and have nobody to hand them to. |
| No overall tracking of a person | The key rotates daily and the site id is part of the identifier. We cannot link you across days or across sites. |
| Anonymous statistics only | A detailed journey is a chain of events within one visit on one day, not a profile of a person. |
| Not combined with other data | Visitor data is separated from account data. There is no key joining the two. |
| Not shared with third parties | Visitor data stays on servers in Germany. Nothing leaves the EU. |
Our design meets all five conditions. It is our assessment, though, not a stamp from a regulator.
- Authorities do not approve individual tools and require a case-by-case assessment.
- That is why we describe the technique in this much detail. Check it instead of trusting it.
When the cookie banner goes and when it stays
- Your site runs only technical cookies and consent-free measurementThe duty to inform stays: keep the processing document somewhere visible.No banner needed
- You also run an ad pixel, an embedded video, a chat or a mapThe banner stays for those. Analytics simply drops out of it.Banner stays
Datrika needs no banner. If yours stays for something else, watch the buttons.
- Analytics is the entry people refuse most often.
For the data subject to have a free choice, refusing consent must be as simple as giving it, which is achieved by placing the button for granting consent and the button for refusing non-technical cookies in the same layer of the cookie banner.
How much data the banner costs you
A tenth to a quarter of visits never reach your statistics. Consent-free measurement has no such hole.
- The figures come from the Didomi benchmark of 19 March 2026.
- Read them with care. Didomi sells consent banners and measures them on its own customers' sites.
- Its consent rate means opt-ins over banners displayed.
- The more honestly the banner is built, the bigger that hole tends to be.
- The numbers you see here are measured, not modelled.
How to check the tool you use today
- 1Open the storage panel in your browser.Cookies or localStorage entries after the page loads? Then you need consent.
- 2Can the reports tell you what one person did last week?If yes, the tool links people across days.
- 3Can you recognise the same visitor on two of your sites?If yes, that is cross-site tracking.
- 4Where does the data sit and is there a transfer outside the EU?The answer belongs in the documentation, not in the marketing copy.
- 5Does the tool offer advertising audiences or an ad platform connection?If yes, it fails the traffic-measurement-only condition.
Sources
Every legal claim on this page can be read in the original. Verified on 14 August 2026.
- Act 127/2005 Sb. on electronic communications, § 89 odst. 3: the duty to obtain consent for storing data in the device and accessing it.
- ÚOOÚ, questions and answers on cookies: technical versus non-technical cookies, the extension to local storage and browser fingerprints, the banner buttons, how long consent lasts, and first-party analytics as an example of legitimate interest. The five conditions for traffic measurement are not there.
- eLegal: Analytické cookies bez souhlasu (7 July 2025): the wording of the five conditions, as the answer the office gave the firm.
- EDPB Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive (16 October 2024): fingerprinting, tracking pixels and tracking links under the same rule.
- Didomi: consent rates in Europe (19 March 2026): figures for 2025.
Read next
- What we store lists every field that reaches our database.
- How we handle GDPR is the legal summary for customers, including our role as processor.
- The Google Analytics alternative without a cookie banner compares the two feature by feature.
- The Google Analytics alternatives overview shows which of eleven tools need consent.
Frequently asked questions
Do I need consent for analytics without cookies?
It depends on what the tool does, not on the absence of cookies. Article 5(3) of the ePrivacy Directive, transposed in Czechia as § 89 odst. 3 of act 127/2005 Sb., ties consent to storing information in the visitor’s device and to gaining access to information stored there. If a tool stores nothing, serves only to measure traffic on your site, cannot link one person’s visits across days or across sites, produces anonymous statistics, does not combine that data with anything else and hands it to nobody, the assessment is that it needs no consent. The call is yours and it is about your site.
Why is "we set no cookies" not enough?
Because the consent rule never mentions cookies. It applies to storing information in the device and accessing it, and a cookie is only the best-known way of doing that. EDPB Guidelines 2/2023, adopted on 16 October 2024, brought browser fingerprinting, tracking pixels, tracking links and some IP-only tracking under the same rule. A tool that swaps a cookie for a fingerprint built from screen size, fonts and graphics card is in a worse position than a cookie, because a fingerprint cannot be deleted.
Where are these conditions written down?
Not on the website of the Czech data protection office, and it is fair to say so plainly. The Czech law firm eLegal published their wording on 7 July 2025, saying the office confirmed them in reply to its query, and noted that this is no blanket permission and every case is assessed on its own. The office’s public cookie page classifies traffic-measurement cookies as non-technical, meaning they do need consent.
Does Datrika read anything from my device?
Yes, four things: screen width, browser language, where you came from and the page address. Claiming we read nothing would be untrue. Width is stored as a bucket such as Full HD, and the language is cut to a two-letter code. We store nothing in the device: no cookies, no localStorage, no sessionStorage.
Do you store the IP address?
No. We use it to derive country, region and city from a database we keep on our own servers, and then we drop it. Only the truncated network goes into the visitor identifier, never the full address.
Will you recognise me tomorrow?
No. The key the identifier is computed from is thrown away every day and replaced. The same visitor gets a different number tomorrow, and a different one on another site, because the site id is part of the calculation.
Can I remove my cookie banner after installing Datrika?
You do not need one because of Datrika. If your site also runs an ad pixel, an embedded video, a chat widget or a map, the banner stays for those. Analytics simply drops out of it.
What should the banner look like if I need one anyway?
The Czech office requires refusing consent to be as easy as giving it, which is achieved by putting the accept and the reject button in the same layer of the banner. The accept button should not be markedly larger or markedly more colourful than the reject button. Pre-ticked boxes are not consent, and closing the banner is not consent either.
Do I have to have a cookie banner at all?
Not always. The Czech office states that a site using only technical cookies, the ones necessary for running it, does not need a banner. The duty to inform remains: the document describing the processing has to be somewhere visible. The moment anything non-technical runs on the site, an ad pixel or an embedded video, the banner comes back for that.
Is analytics a legitimate interest?
The Czech office names processing for first-party analytics as an example of legitimate interest. Mind the two layers though: legitimate interest is a GDPR basis for processing the data, while storing a non-technical cookie in the device needs consent under the electronic communications act. Datrika stores nothing in the device, so the first layer does not arise.
How long does banner consent last?
The Czech office treats 12 months as reasonable. If a visitor refuses, the banner should not ask again for at least 6 months, unless the processing changes significantly, for example when the purposes change or data stops leaving the EU.
Are you approved by the regulator?
No, and nobody is. Data protection authorities do not certify individual tools. We show how our design maps onto the conditions and describe the technique in enough detail that you can check the conclusion yourself.
What about Google Analytics?
Google Analytics is legal in Czechia, but it stores an identifier in the device, so the measuring code must not run before the visitor clicks Accept. The banner stays, and you lose the visitors who refuse.
Measure without a cookie banner
One line in your page and you see your first visitors within a minute. No card, no consent.
Start with Datrika