Privacy-friendly web analytics: measuring what counts without cookie banner chaos

Every business owner wants to know whether their website works. How many people come, where do they come from, and do they get in touch? At the same time, the answer to “how do I measure that without a cookie banner that scares off half your visitors?” is less simple than it seems. In this article we line up what the Dutch Data Protection Authority (AP) and the French regulator CNIL say about analytics cookies, what Google Analytics and a cookieless alternative such as Plausible say about themselves, and how to choose. Note: this is general information and not legal advice. The rules depend on exactly how your tool is configured; have it checked if you are in doubt.

First: which figures do you really need?

Most small businesses are fine with a handful of figures:

1. Visitors and pages: how many people come and which pages are read?
2. Origin: do they come via search, social, an ad or directly?
3. Enquiries: how many forms, calls or appointments result?
4. Searches in Google: what are you found for? That is what Google Search Console is for, which according to Google shows how your site performs in Google Search and helps you find problems.
5. Speed and problems: see Core Web Vitals explained.

Anything on top of that, such as profiles of individual visitors or links to ad networks, is only needed if you have a clear purpose for it. The less you collect, the less you have to explain.

What does the AP say about analytics cookies?

The AP distinguishes three types of cookies: functional cookies, limited analytics cookies and other cookies. Of the second type the AP says they collect information about visits to a website, such as the number of visitors and the most visited pages, and that they may not have major consequences for privacy. If they have no or little impact, then according to the AP no consent is needed; that is in the Telecommunications Act (article 11.7a). Two caveats the AP itself makes: if such cookies process personal data, the owner needs a legal basis under the GDPR, and the use must be stated in the privacy statement. Tracking cookies, which follow behaviour across multiple websites and apps, fall under other cookies and do require consent.

What does not count as valid consent is set out in an AP news item from December 2019, after a check of about 175 websites: almost half of the websites using tracking cookies did not comply. Consent requires an unambiguous, active action; a pre-ticked box is not allowed, and neither are silence, inactivity, scrolling down or “you agree if you continue on this site”. A cookie wall, where you only get access if you accept tracking cookies, also does not comply with the GDPR according to the AP. More on that in cookies and GDPR for your website.

What does the CNIL say?

In its information sheet on analytics, the French regulator CNIL describes that measurement cookies in principle require consent, but are exempt under conditions. Those conditions include: informing users and giving them the ability to object, limiting the purposes to audience measurement and A/B testing, not combining the data with other processing, limiting the scope to a single site or app, truncating the last byte of the IP address and limiting the lifetime of the cookies to 13 months. The CNIL immediately adds that most large measurement services, regardless of their configuration, do not fall within that exemption, and names self-managed open-source software such as Matomo as an alternative. This is a French reading of the ePrivacy directive; the Netherlands has its own regulator and legislation. Use it as an illustration of what a regulator means by “limited”, not as Dutch law.

What does Google Analytics say about itself?

Google has a page with privacy settings in Google Analytics. It states, among other things, that you can disable collection of granular location and device data per region, that you can have email addresses and self-chosen URL parameters redacted, that you can set the data retention period, that Google signals and advertising features can be turned off and that IP addresses are not logged or stored in Google Analytics. Those are useful settings. But they do not answer whether consent is needed for using the tool in your situation, nor whether you are sending data to a third party that you must mention. It also shows you have to make choices: by default many things are on, such as the collection of granular location and device data, which can be turned off.

And a cookieless alternative?

In its data policy, Plausible Analytics describes that it does not use cookies and does not generate persistent visitor identifiers, that it does not track people across devices, websites or apps and that it does not store raw IP addresses or user-agent strings. It says it is hosted in the EU. That is a statement by the vendor about itself, not a ruling by a regulator; read each tool's policy yourself and record in your privacy statement what you use. In general, though: a tool that sets no cookies and follows no individuals asks less of your visitor and of you. The downside is that you have less detail: no long-term profiles and less insight into individual journeys. For most small businesses that is no loss.

Measuring with consent: when is it needed?

If you use advertising platforms, for example for Google Ads, you want to feed conversion data back. Google explains that you define yourself what a conversion is, and points out to advertisers in the EEA that the consent rules must be followed and Consent Mode must be set up. That means you need a consent banner and must link the measurement to it. In that case it is important to make the banner honest: no pre-ticked boxes, no cookie wall and no tracking beforehand. In our view refusing should also be as easy as accepting. A small site without ads can often avoid that with a cookieless tool, so you need no banner at all.

How to choose

1. Write down which questions you want to answer. The purpose determines the tool.
2. Choose the lightest tool that can do it. Without ads, Search Console and a cookieless analytics tool are often enough.
3. With ads: set up consent and conversion measurement properly and test both.
4. Record it. In your privacy statement, put which tools you use, for what purpose, how long you keep data and with whom you share it.
5. Limit what you store. Set a short retention period where possible.
6. Check yearly. Tools and rules change, and a new plug-in can quietly add tracking.

Common mistakes

• A banner that asks for consent in the wrong way. In 2019 the AP found that almost half of the checked websites with tracking cookies did not comply.
• Tracking before consent. Check in your browser's network tab what loads beforehand.
• A tool nobody looks at. Measuring only makes sense if someone looks at the figures monthly and does something with them.
• Measuring too much, concluding too little. One number of enquiries a week says more than forty charts.

In conclusion

Measuring need not be complicated. Start with the questions, choose the lightest tool and explain what you do. We set up measurement and the privacy statement as part of our websites, and make sure through hosting and maintenance that it stays correct. Book a free intro call.

Sources

Reviewed on 28 October 2026 against the sources below. Rules and guidelines change; this article is general information, not legal or tax advice.

• Cookies (Autoriteit Persoonsgegevens)
• AP: veel websites vragen op onjuiste wijze toestemming voor het plaatsen van trackingcookies
• Sheet n°16: Use analytics on your websites and applications (CNIL)
• Privacy controls in Google Analytics (Analytics Help)
• Plausible data policy
• About conversion tracking (Google Ads Help)
• About Google Search Console

Book an intro call