GVD Holdings

Notes /

Analytics without cookies: do you still need a cookie notice?

Reviewed by Expert review: Claude (AI, Legal Compliance Checker) with cited sources

A cookie-free analytics tool does not settle the question of a cookie notice by itself. Umami states in its own FAQ that its web tracker does not use cookies. The same FAQ also says that whether a website needs a cookie notice depends on the other services it uses and on the requirements that apply to it.

Short answer

Not using cookies in the analytics tool is one fact. Whether a site needs a notice is a separate question, and it depends on the whole site, the country the visitors are in, and the rules that apply there. Umami's FAQ does not give a yes or no, and neither does this page.

What Umami's tracker does and does not use

According to the Umami FAQ, the web tracker does not use cookies. The FAQ says the tool is designed with privacy in mind, and it adds that GDPR compliance depends on how the tool is configured and used. A tracker that sets no cookie is different from a site that sets none. A page can load other scripts, embedded videos, fonts, chat widgets or advertising tags, and any of these may set cookies or otherwise need a notice.

What data it collects

The FAQ lists the data Umami collects: pageviews, referrer URLs, browsers, operating systems, device types and approximate location.

Each item is a kind of information about a visit. It is not the same as a name or an account. Whether a particular combination of data is personal data under a given law is a legal question, and the FAQ leaves that to the site owner and the applicable rules.

Other services on the page can change the answer

The FAQ states that whether a cookie notice is needed depends on the other services a site uses. That means a site that uses no cookies for analytics may still need a notice because of a different service. The reverse is also possible: a site with a notice for other reasons still needs to check what the analytics tool does.

This is why an answer about one tool cannot be copied to another site without checking its full setup.

Self-hosting and how long data is kept

The FAQ states that for self-hosted installations, data is kept indefinitely unless the site owner deletes it manually. Self-hosting means the data stays on a server the site owner runs, rather than with a third-party provider. It does not by itself decide whether the data is lawful to keep.

Retention is therefore a setting the owner should decide on and document. The FAQ does not set a period for deleting data, and this page does not suggest one.

How this website does it

This website uses a self-hosted counter. The note how this website counts visits without cookies describes the setup in more detail. Read that note for the specifics, and check the privacy page for what the site says about its own practice.

The note on counting visits describes what this site's setup does. It does not decide whether any other site needs a notice.

Questions to put to the answer

When you read any claim that "no cookies means no notice", ask:

  • Does the page load anything else that sets a cookie or stores data on the device?
  • Which of the collected items does the site actually need, and for how long is each kept?
  • Who runs the server that holds the data, and where is it located?
  • Which country's rules apply to the visitors, and what do they require?

Each of these is a question about the site, not about the analytics tool.

Where to check the rules for your country

Cookie and privacy rules differ by country and change over time. The points to check are:

  • The text of the privacy law that applies to the site and its visitors, read from its official source
  • The guidance of the data protection authority in the relevant country
  • The services and scripts actually loaded on each page

This page is general information. It is not legal advice. A site owner who needs a definite answer should ask a qualified adviser who knows the rules for the countries where visitors are located.

Sources