In almost every website project we hear one of two sentences: “Without a cookie banner we can’t measure anything.” Or: “We have a banner anyway - so let’s measure everything.” Both lead in the wrong direction. One gives away useful knowledge; the other collects data nobody needs - and annoys every visitor.
On top of that, data behind a banner is incomplete anyway. In France, around 39% refused cookies in June 2022 according to surveys for the data protection authority CNIL (CNIL, 2023). In an experiment, the rejection rate ranged from 27% to around 80% depending only on the banner design (Congiu, Moscati, Scacchi, 2024). What is measured behind a banner therefore depends heavily on what the banner looks like.
What is actually restricted
Simplified, there are two rules worth keeping apart:
- Access to the device. Storing or reading information on the device - cookies, local storage, fingerprinting - requires consent. Exempt is what is strictly necessary for the service the user asked for (Section 25 TDDDG, based on the ePrivacy Directive).
- Processing personal data. It needs a legal basis. Profiles across people and visits effectively require consent.
A count that stores nothing on the device and doesn’t distinguish between people doesn’t touch the first rule and barely touches the second. There is a lot of room - you just have to use it deliberately.
The decision first, then the metric
Before we measured anything on this website, we wrote down which decisions we wanted to make with it:
- Which articles and references are in demand - and should we show them more prominently?
- Is there sudden interest in a topic we should respond to?
- Where does our AI assistant find no matching content?
None of these questions requires knowing who opened a page. It is enough to know how often a piece of content was opened on a given day.
Five rules that make it work
Name the decision - what do we need the number for?
Smallest metric - what is just enough for that?
Aggregate at the source - store counters, not individual events
Nothing on the device - no cookies, no local storage, no fingerprinting
Retention to match the purpose, explained openly - what is only needed briefly gets deleted; plain counters may stay
Technically it is small: when a page loads, it only sends its path to our server. There, a counter for content item and day goes up by one - no IP, no identifier. We also count whether content was opened via our AI assistant - as a number, not per person. Because these counters are anonymous, we may keep them permanently. Over years, this shows us when a topic is booming, when it fades - and whether the share of people reaching content via the assistant rather than by clicking is growing. Once an hour this becomes an overview that the cards on this website use for their badges: “New”, “Hot” and “x views in 7 days”. The details are in our privacy policy.
What you give up
Honestly: quite a bit. We don’t know how many different people visit us, who comes back or which campaign brought someone here. For a content and advisory website in B2B, we don’t need that. Anyone who does - for conversion optimisation in a shop, say - should openly ask for consent rather than trying to work around the banner.
The point is a different one: most companies don’t measure too little, they measure the wrong things. If you start with the decision, you measure less, understand more - and rarely run into data-protection problems.
Not legal advice: whether a solution works without consent depends on the concrete implementation. Involve your data protection officer early.
