Analytics that don't break GDPR — and don't lie to you either.

For ten years, the deal was: cookies in exchange for understanding. Both halves of that deal aged badly. Cookies got blocked, banners got dishonest, and the data got worse anyway.

What's actually required

Under GDPR and ePrivacy, anything that stores or reads information on a user's device for non-essential purposes requires consent. That includes cookies, localStorage, and most browser fingerprinting techniques. Hashing an IP doesn't help — pseudonymous data is still personal data.

Three honest approaches

• Cookieless first — generate a daily-rotating session ID, no cross-session tracking. Compliant by default, no banner needed.
• Consent-gated — load the full tracker only after a real opt-in. Richer data, fewer visitors covered.
• Hybrid — anonymous funnel + consented replay. The model most modern teams settle on.

What we recommend

Start cookieless. You'll lose nothing important. Page views, conversions, funnel drop-off, friction signals — all measurable without a single persistent identifier. The only thing you'll miss is cross-session attribution, and frankly the attribution you had before was always more fiction than fact.

When a visitor opts in, upgrade them to full tracking — replay, identity stitching, cross-device. Best of both: a clean baseline that respects everyone, and rich insight on the people who said yes.

The banner problem

If your banner has an Accept All button bigger than the Reject All button, you're not compliant. If it auto-accepts after a delay, you're not compliant. If continuing to scroll counts as consent, you're not compliant. The regulators have been clear and the fines are real.

The good news: when you stop trying to harvest everyone, the banner gets smaller, the page gets faster, and the data you do collect gets more honest. Everyone wins.