The banner you don't need

GDPR never mentions a cookie banner. It regulates personal data, and a banner is only one way of asking permission to process some of it. Plenty of sites are collecting consent for tracking they could simply stop doing instead.

What GDPR actually says about analytics

GDPR applies to the processing of personal data, so the question for any analytics tool is whether it processes any. That covers more than names and emails: IP addresses, cookie identifiers, device fingerprints, precise location, anything that tells one visitor apart from another.

If your tool touches any of that, you need a lawful basis. Most sites reach for one of two: consent under Article 6(1)(a), which is what a banner implements, or legitimate interest under Article 6(1)(f), which needs a business reason that outweighs the individual's rights and a documented balancing test to show it.

There's a third route, and it gets overlooked because nobody makes money selling it. If the tool doesn't process personal data at all, the consent question never arises.

The ePrivacy Directive matters too

GDPR isn't the only rule in play. The ePrivacy Directive, the one everyone calls the Cookie Law, governs storing information on a visitor's device and reading it back. Under Article 5(3), doing either needs consent regardless of whether the information is personal data, and analytics doesn't fall under the narrow carve-out for what's strictly necessary. That's why Google Analytics needs a banner even where legitimate interest might otherwise cover it.

Be precise about the trigger, because vendors are sloppy with it: it's storage and access, not the word "cookie". The rule bites the moment information on a device, or anything derived from it, leaves the device. Moving an identifier from a cookie into local storage gets you out of nothing.

How Cabin does it

The principle is boring, which is rather the point. Don't set cookies, and the ePrivacy trigger doesn't fire. Don't process personal data, and GDPR's consent question doesn't arise. Don't fingerprint either - hashing an IP with a user agent to make a "pseudonymous" identifier is still building an identifier out of personal data.

Cabin does none of the three, from the start, and none of it is a setting you can leave switched off by accident. No cookies, first-party or third-party, session or persistent. No unique identifier for a visitor: no UID in a database, no hash of IP and user agent, no fingerprint of any kind.

IP addresses are never stored

This is the one worth stating carefully, because a lot of vendors state it carelessly. A visitor's IP arrives with the request, the way it does with every request to every server on the internet. Cabin holds it in memory just long enough to look up a country, then discards it: never written to disk, never logged, never attached to a visit record.

Holding an address in memory at all is processing under GDPR, so Cabin doesn't claim it never processes IP addresses, however well that would read on a pricing page. I'd rather write the version that survives a question: nothing outlives the request, and there's no stored value for it to be matched back to.

The Last-Modified method

Instead of cookies or fingerprinting, Cabin uses the browser's own HTTP caching to count return visits: a Last-Modified header encodes a visit count inside a timestamp, living only in the browser's cache and gone the moment it's cleared. Nothing in it identifies anyone. Full write-up: how Cabin measures unique visitors without cookies.

EU data storage

All Cabin analytics data is stored and processed in the EU, with a backup in London. A handful of collection endpoints outside the EU exist purely to receive a request quickly and pass it to Ireland, nothing written to disk, same IP rule as above. Cross-region transfers run under Standard Contractual Clauses.

What regulators have said

France's CNIL has the most concrete version of this: audience measurement is exempt from consent, strictly on conditions - limited to your own site, no cross-site following, no cross-referencing, truncated IPs, a 13-month tracker expiry, visitors told and able to object. Most large audience-measurement products fall outside this however you configure them.

Read that as a boundary, not a permission slip. Cabin sits well inside it - no tracker to expire, no IP to truncate, nothing to cross-reference.

The Dutch DPA draws a similar line: no consent needed for "limited analytics cookies" with no or little privacy impact, though a lawful basis still applies wherever they do process personal data. The exemption is for counting, not profiling.

Neither is a blanket right to skip consent, and anyone who tells you it is hasn't read them. Both describe the same shape: first-party, narrow, nothing joined to anything else.

Four excuses that don't hold up

• "We anonymise IP addresses." Truncating or hashing beats keeping it in full, but it doesn't undo the processing that happened before truncation, which is where the personal data was.
• "We delete the data after 24 hours." Temporary processing is still processing.
• "We do it server-side." Changes where the code runs, not the legal analysis - an identifier built from an IP and a user agent is still an identifier.
• "Our privacy policy covers it." A policy tells people what you do. It isn't a lawful basis for doing it.

Checking your own setup

Most of this you can check in a few minutes. Open dev tools and see what your analytics tool writes to the cookie jar and local storage. Then ask the vendor, in writing. Are IP addresses stored? Is an identifier generated per visitor? Is data combined with anywhere else? If they can't answer plainly, that's the answer.

What you get back

Dropping the banner isn't only a legal tidy-up. You measure everyone rather than the subset who clicked accept, so the numbers stop having a gap shaped like whoever finds banners irritating. You lose the consent-management script and the standing job of testing it. And the first thing a visitor sees is your actual site.

Cabin is free to start: one line of script, no credit card, nothing for a visitor to dismiss before the page loads. Free covers 10,000 pageviews a month across 10 domains, plenty to see whether the numbers look right. If you look after sites for other people, there's more on how this works for agencies and studios.