Guide / Last reviewed
Do you need consent for web analytics?
It depends on the country, not just on whether you use cookies. Here is how we read the rules in the countries our customers ask about most, with links to the law and the regulators’ own guidance.
The short answer
In the EU, storing or reading information on a visitor’s device needs consent unless it is strictly necessary for the service they asked for[1]. Analytics is not strictly necessary under the directive itself, but France, the Netherlands, Italy and the United Kingdom allow privacy-friendly audience measurement without consent under conditions. Denmark and Germany do not. Whenever personal data such as an IP address is processed, the GDPR applies as well[2].
Country by country
The last column is the mode Nordtally suggests when you add a site for that country. You can always choose another.
| Country | Rule | Without consent? | Suggested mode |
|---|---|---|---|
| Denmark | Cookie Order[4], joint guidance from Digitaliseringsstyrelsen and Datatilsynet[5] Visitor statistics need consent. The rules cover cookies and similar technologies such as pixels and fingerprinting, and there is no exemption for statistics. | No | Strict |
| Germany | § 25 TDDDG[6] Consent is required unless access is strictly necessary. There is no exemption for analytics. | No | Strict |
| France | CNIL guidance on audience measurement[7] Audience measurement for the publisher alone, producing anonymous statistics, with no tracking across sites and no sharing. The CNIL recommends trackers last at most 13 months and data be kept at most 25 months. | Under conditions | Anonymous |
| Netherlands | Telecommunicatiewet art. 11.7a(3)(b)[8] Allowed without consent to learn about the quality or effectiveness of the service, provided it has little or no effect on the visitor’s privacy. | Under conditions | Anonymous |
| Italy | Garante guidelines of 10 June 2021[9] Analytics are treated like technical cookies when visitors can’t be singled out (for example, part of the IP address is masked), statistics are aggregate, measurement is limited to one site or app, and the provider doesn’t combine the data with anything else. | Under conditions | Anonymous |
| United Kingdom | PECR as amended by the Data (Use and Access) Act 2025[10], ICO guidance[11] An exception for statistical purposes only: visitors must get clear information and a simple, free way to object. | Under conditions | Anonymous |
| Sweden, Norway, Finland, Iceland | National implementations of Article 5(3) We don’t rely on a specific analytics exemption in these countries. Ask your data protection officer; strict mode is the most conservative choice. | Check locally | Anonymous |
What “cookieless” does and doesn’t change
Article 5(3) is about storing or accessing information on the device, not about cookies as such. The European Data Protection Board reads it as covering tracking pixels, fingerprinting and other techniques too[3], and the Danish guidance says the same. So a tool without cookies is not automatically exempt from consent.
That is why Nordtally has three modes instead of one promise. Strict mode keeps no identifier of any kind. With server-side or edge collection, nothing runs in the visitor’s browser at all: your own server reports the page view. In countries without an analytics exemption, that is the most conservative set-up, and the one we suggest.
The GDPR still applies
Even without cookies, a request carries the visitor’s IP address, which is personal data. Nordtally uses it in memory to look up the country, to filter bots and, in anonymous mode, for the daily visitor hash, and never stores it. The usual basis for that processing is legitimate interest (Art. 6(1)(f) GDPR), which gives visitors the right to object (Art. 21 GDPR). In consented mode, the statistics cookie and the data linked to it rest on consent (Art. 6(1)(a) GDPR).
The compliance centre in the dashboard turns your site’s actual settings into the matching privacy notice text, an Art. 30 record of processing, and, for French sites, a check against each CNIL condition.
How the modes compare
- Strict: no identifier, nothing on the device. Page views, sources, pages and countries; no unique visitors.
- Anonymous: a salted hash that can’t survive midnight, nothing on the device. Adds daily unique visitors, bounce rate and visit duration.
- Consented: one first-party cookie, only after the visitor agrees. Adds returning visitors across days.
The full comparison is on the home page.
Sources
All links checked on 3 November 2026.
- Directive 2002/58/EC (ePrivacy Directive), Article 5(3)
- Regulation (EU) 2016/679 (GDPR), Articles 6 and 21
- EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, version 2.0 (October 2024)
- Denmark: Cookie Order, BEK nr. 1148 of 9 December 2011
- Denmark: Digitaliseringsstyrelsen and Datatilsynet, “Brug af cookies og lignende teknologier” (May 2025)
- Germany: § 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz)
- France: CNIL, “Cookies : solutions pour les outils de mesure d’audience”
- Netherlands: Telecommunicatiewet, article 11.7a(3)(b)
- Italy: Garante, “Linee guida cookie e altri strumenti di tracciamento” (10 June 2021)
- United Kingdom: Data (Use and Access) Act 2025
- United Kingdom: ICO, guidance on storage and access technologies, “What are the exceptions?”