Short version: if your analytics sets cookies (or uses localStorage), UK law says you need consent first — yes, even for "harmless" visitor counting. If your analytics stores nothing on the visitor's device, that particular legal trigger never fires. That difference is why cookieless analytics exists as a category, and it's worth understanding precisely, because half the advice online blurs it.
The banner requirement most people mean comes from the Privacy and Electronic Communications Regulations (PECR), regulation 6: storing information on someone's device, or reading information already stored there, requires telling them and getting consent. Cookies are the famous case, but the wording covers localStorage, sessionStorage and similar too. There are only two exemptions — storage needed to transmit the communication, and storage strictly necessary for a service the visitor asked for. A shopping basket cookie is strictly necessary; the regulator's long-standing position is that analytics is not. "It's just aggregate stats" doesn't change that — the exemption is about what the visitor needs, not about how benign your intentions are.
So the common setup — Google Analytics or any cookie-based tool, plus a banner — isn't over-caution. With cookie-based analytics, the banner (or some real consent mechanism) is what the law asks for, and "by using this site you accept cookies" doesn't count as consent under UK GDPR's standard, which PECR borrows.
PECR's trigger is storage and access on the device. Analytics that sets no cookies, writes no localStorage, and reads neither has nothing for regulation 6 to bite on. That's the honest logic of cookieless analytics: not a loophole, just staying outside the thing the rule regulates.
But — and this is the part vendors say quietly, if at all — GDPR still applies separately. Cookieless tools still receive each visitor's IP address in the request, and an IP address can be personal data. So "no cookies" alone doesn't end the conversation; what matters is what happens to that IP next. A well-designed tool uses it transiently (for example, hashing it with a salt that is later destroyed) and never stores it, so what lands in the database is anonymous. A badly-designed "cookieless" tool that quietly builds persistent device fingerprints has recreated the tracking problem without the cookie — arguably worse, because the visitor can't even clear it. If you're comparing tools, here's what to ask any vendor.
Removing analytics cookies removes the analytics reason for a banner. Whether your site needs one overall depends on everything else it does: embedded YouTube videos, ad networks, social buttons, chat widgets and font services all commonly set cookies or similar identifiers of their own. Switching analytics won't fix those, and no analytics vendor can promise "no banner for your site" — only "nothing to banner about from us". Audit the rest before you delete the banner: your browser's developer tools (Application → Cookies/Storage) will show you exactly what's being set and by whom.
To run analytics without a consent prompt in the UK, you want all of these to be true: the tool sets no cookies and uses no device storage; it stores no raw IP addresses and builds no cross-day identifier (so what's kept is genuinely anonymous, not pseudonymous); it honours Do Not Track and Global Privacy Control rather than arguing they don't count; and your privacy page says plainly what is measured. Then check the rest of your stack for third-party storage. If everything passes, the banner has nothing left to do — for analytics, at least.
Accurate to the best of our knowledge as of August 2026; PECR reform has been discussed for years, so check the ICO's current cookies guidance for anything load-bearing. This is a plain-English explainer by an analytics vendor, not legal advice — for a specific compliance question, ask a professional. Comparing vendors? Google Analytics alternatives, compared honestly. CAAC.