In this article
This site has no cookie banner. We didn't decide that at the end. It followed from a few small choices along the way, and none of them were hard.
This month our site showed up in Google for “cookiefreie website”, German for cookie-free website. It was far down the results, but it's a good question, and the answer is the same for almost any site. So here is the whole list: what the banner is for, how to find out what your site sets, and what to use instead.
What the banner is actually for
In the EU, the rule behind the banner is Article 5(3) of the ePrivacy Directive. Each country has written it into its own law: in Germany that is §25 of the TDDDG, and the UK has its own version too. It says a website needs the visitor's consent before it stores anything on their device or reads anything from it. The one exception is when that is strictly necessary for something the visitor asked for.
The rule doesn't actually mention cookies. Local storage, session storage and IndexedDB count just the same. In 2024 the EU's data-protection board published guidance arguing that it also covers tracking pixels and some kinds of IP-based tracking. So swapping a cookie for local storage doesn't get you out of it. A cookie-free website is really a website that doesn't store anything the visitor didn't need.
So the banner isn't a fixed cost of having a website. It's there for specific things on your site, and you can usually name them.
What you can keep without asking
You don't need zero cookies. You need zero cookies that you'd have to ask about. These are generally treated as strictly necessary, and they need no banner:
Keeping people signed in
A session cookie or token that keeps someone logged in after they chose to log in.
A basket
Remembering what someone put in their basket. They asked for that when they clicked “Add to basket”.
Choices the visitor made
Language, dark mode, a dismissed notice. If it only saves something the visitor picked, and isn't an ID that follows them around, it is usually treated as necessary.
Security and load balancing
Protection against forged form submissions, and keeping a visitor on the same server. Things the site can't work without.
This is roughly everything this site keeps in a browser: what signing in needs, and settings people pick themselves. Nothing on it is for us to learn about visitors, so there is nothing to ask about.
Find what your site sets
Most sites that have a banner don't know exactly why. It came with a plugin or a theme, or with a tool someone added years ago. Finding out takes about five minutes:
- Open your site in a private window, so nothing from earlier visits gets in the way. Don't click anything yet, and that includes the banner.
- Open the developer tools (F12, or Cmd+Option+I on a Mac) and go to Application in Chrome and Edge, or Storage in Firefox and Safari. Look at Cookies, Local storage and Session storage, for your own domain and for every other domain listed there.
- Switch to Network and reload the page. Every domain in that list that isn't yours has just been sent the visitor's IP address, whether or not it set anything.
- Do the same on a page with a form, a video or a map. These often load their own scripts, and your homepage won't show you those.
A small site in a private window, before any click
Illustration, not a real audit
Google Analytics
_ga and _ga_<id> cookies, kept for two years
Needs consent
A YouTube video, embedded
Cookies and local storage, before anyone presses play
Needs consent
A chat widget
A visitor ID cookie, so it can pick the conversation up again
Needs consent
An ad pixel from a past campaign
_fbp cookie, kept for three months
Needs consent
Fonts from fonts.googleapis.com
No cookies, but every visitor's IP address goes to Google
No banner, still a GDPR question
Your own shop's basket
One cookie, once something is put in the basket
Necessary: they asked for it
Swap, delay or drop
For almost everything on that list there's a version that stores nothing, or one you can load only when the visitor asks for it:
| What sets it | Cookie-free instead |
|---|---|
| Analytics | A tool that sets no cookies and stores nothing in the browser. There's more on how they count below. |
| YouTube and Vimeo embeds | A preview image with a play button that only loads the player when it's clicked. For Vimeo, also add dnt=1 to the player URL. YouTube's privacy-enhanced mode (youtube-nocookie.com) holds some of it back, but it doesn't make an embed storage-free. |
| Google Maps | A static map image that links to the map, or the same click-to-load approach. |
| Chat widgets | An email address or a contact form. Or load the widget only when someone clicks “Chat”. |
| Social share buttons | Plain share links. They're ordinary URLs, so they don't load anything until someone clicks one. |
| reCAPTCHA | On a small site, a hidden honeypot field and a limit on submissions per minute stop most form spam. |
| Fonts from Google | Host the font files yourself. Almost everything on Google Fonts is open-licensed, so you can download it and serve it from your own domain. |
| Ad and social pixels | There is no cookie-free version, because tracking is the whole point. If you run ads that depend on them, keep the banner for them. If you don't, remove them. |
The click-to-load approach is what German sites call the two-click solution. The first click shows what will load and who it comes from. The second one loads it. At that point the visitor has asked for the video, so nothing loaded before they chose it.
Analytics without cookies
Analytics is usually the main reason a small site has a banner, and it's also the easiest to replace. A tool like Google Analytics recognises a returning visitor by an ID it stores in a cookie. That cookie is exactly what the rule is about.
Cookie-free tools leave the browser alone. Instead the server creates a key from the visitor's IP address and browser, mixed with a random value that belongs to one day and is then deleted. The same person on the same day gets the same key. The next day they get a new one, and nobody can connect the two, not even the tool itself. The IP address is used to create the key, and only the key is kept.
You give up a few things. A regular reader counts once per day, not once per month. And you can't follow one person across devices or across weeks. In return the numbers include the people who would have declined or ignored a banner, and on many sites that's a large share. There's a longer explanation of why cookie-based and cookie-free tools report different numbers, and how to compare them.
Some regulators go further. France's CNIL lets certain analytics cookies run without consent when they only produce anonymous statistics for the site's own owner, aren't combined with other data, last no longer than 13 months, and meet a few other conditions. That's useful to know, but the exception doesn't apply everywhere. A tool that stores nothing doesn't need one.
Cookie-free isn't rule-free
Removing the banner doesn't mean privacy law no longer applies to your site. A few things still do:
- GDPR still applies. An IP address is personal data, even if you only handle it for a moment. Your privacy policy should still say which tools you use, what they collect and why.
- Third parties get the visitor's IP address anyway. Fonts are the classic example. In January 2022 a court in Munich ordered a website owner to pay a visitor €100, because the site loaded Google Fonts from Google's servers and so passed the visitor's IP address to Google.
- Check “cookie-free” claims. A tool that has dropped cookies but writes an ID to local storage is still storing something on the device. Check the tool's documentation, or check your browser's storage.
- This isn't legal advice. The rule described here is European. Other places ask different questions. If your site handles anything sensitive, or the answer matters to your business, ask someone who does this for a living.
The goal isn't a website with no cookies at all. It's a website where every cookie is one the visitor asked for.
Lomen is a cookie-free analytics tool of the kind described above. The script sets no cookies, and it stores nothing in the browser unless you turn that on. IP addresses are never stored, and unique visitors are counted from a daily key, the same way Plausible does it. It can't tell you who came back last Tuesday. It can tell you where today's visitors came from, and Lomen AI can explain why one day was busier than usual.