WordPress analytics without a cookie banner

Short answer: Omea Analytics measures visits with no cookies or device storage until a visitor gives Statistics consent, so for analytics alone you may not need a banner in France or the UK. Whether you can drop the banner depends on your country and on everything else your site loads – ad pixels, YouTube embeds and Google Analytics still need consent.

This guide explains what the rules say, what Omea Analytics does before consent, and the three setups you can choose from.

This is product documentation, not legal advice. The rules below are current on the date shown above; check them with your data protection adviser.

What the rules say

The cookie rules (Article 5(3) of the EU ePrivacy Directive and the national laws that implement it) require consent for storing or reading information on a visitor’s device, unless an exemption applies. They are about the device, not only cookies.

Where	What applies to audience measurement	Source
France	Exempt from consent if it only measures your own site’s audience, produces anonymous statistics, isn’t combined with other data or passed to third parties, and doesn’t track people across sites. CNIL recommends telling visitors (for example in the privacy policy), cookies of at most 13 months and data kept at most 25 months.	CNIL – audience measurement tools
United Kingdom	Since 5 February 2026, storage or access only for statistics about how your service is used, to improve it, needs no consent – if visitors get clear information and a simple, free way to object. Not for profiling, tracking individuals or advertising.	PECR Schedule A1, para. 5 · ICO – exceptions
Germany	§25 TDDDG allows storage or access without consent only when strictly necessary; there is no analytics exception. Measurement that neither stores nor reads anything on the device falls outside §25, but where that line runs is debated.	§25 TDDDG
Rest of the EU	National rules differ. The EDPB’s Guidelines 2/2023 read Article 5(3) broadly: it can cover tracking pixels, tracking links and information a script collects on the device, not just cookies.	EDPB Guidelines 2/2023

The GDPR applies on top of all of this: you need a lawful basis for the processing (usually legitimate interests for privacy-friendly statistics) and an entry in your privacy policy.

What Omea Analytics does before consent

With the default Measure cookieless setting:

• Nothing is stored in the browser – no cookies, no localStorage, no other storage.
• A visit is recognised on your server by a one-way hash of the IP address (the /64 network for IPv6), browser, language and site, under a random key that is replaced every day. The old key is deleted half an hour after midnight, so a visitor can’t be linked across days.
• IP addresses are never stored, nor coordinates, query strings, or user, order and contact IDs.
• The data stays in your WordPress database. Nothing is sent to Cultmetrics or any third party, and nothing is combined with other sites.
• Bots and vulnerability scanners are filtered out before anything is stored.

What the tracker does read in the browser, so you can judge it against the EDPB’s broad reading: the page address (only UTM parameters and the type of an ad click ID are kept), the referring site’s address without its query string, a screen-width bucket (four sizes) and whether the device has a touch screen. Device, operating system and browser come from the request headers on the server.

Choose your setup

1. Cookieless, without a banner

For sites that load no other tracking: no ad pixels, no Google Analytics, no YouTube or Maps embeds that set cookies.

1. Install and activate Omea Analytics. Measure cookieless is the default under Omea Analytics › Settings › Privacy.
2. Optionally turn off With Statistics consent: recognise returning visitors on the same tab. Without a consent banner nobody can give that consent, so the cookie is never set either way; turning it off makes that explicit.
3. Add the plugin’s suggested text to your privacy policy: Settings › Privacy in WordPress shows it in the policy guide. The Get set up checklist reminds you until the policy mentions Omea Analytics.

UK sites: the statistics exception requires a simple, free way to object. Omea Analytics doesn’t have a visitor opt-out link yet, so if you rely on the UK exception, use setup 2 or 3 for now.

2. Cookieless plus a banner for everything else (most common)

Most sites also run marketing tags or embeds, so they need a banner anyway. Then:

1. Install Omea Consent (free) or keep the banner you have, if it supports the WP Consent API.
2. Keep Measure cookieless in Omea Analytics.

Visits are counted from the very first page, including visitors who never click the banner, so your numbers don’t depend on the consent rate. When a visitor accepts Statistics, Omea Analytics also recognises them on later visits and credits conversions to the campaign that first brought them.

3. Record nothing before consent (strictest)

Choose Record nothing before Statistics consent under Omea Analytics › Settings › Privacy. No pageviews or events are recorded until the visitor allows statistics; the page they are on is counted at that moment. The rule is enforced on the server too, so server-side events such as purchases follow it. Use this if your adviser reads the rules strictly, for example for German sites.

When you still need a cookie banner

Cookieless analytics doesn’t make the rest of your site cookieless. You need consent for:

• Google Analytics 4, Google Ads, Meta Pixel, TikTok, LinkedIn and other ad or analytics tags
• YouTube, Vimeo and Google Maps embeds
• chat widgets, A/B testing and heatmap tools that store data in the browser

Omea Consent holds those until consent, and its free cloud scan shows what your site sets before anyone clicks.

Check it yourself

Open your site in a private window, open the browser’s developer tools and look at Application › Cookies and Local storage before you accept anything. Omea Analytics adds neither. In the Network tab you’ll see one request to omea-analytics-collect.php (or the REST fallback) per page, and one more when you leave it.