Does website analytics need a consent banner? Break it down by region and method

First, a disclaimer: this isn't legal advice. Requirements differ a great deal by country and industry, and the final decision belongs with your legal team or privacy adviser.

What this post tries to do is break "do we need a consent banner?" into smaller questions you can actually answer, so you can describe your situation clearly when you talk to legal.

Question 1: where are your visitors?

Regions differ on when consent is needed. Roughly:

• EEA and UK. Storing or reading information on a user's device (cookies and similar technologies) usually needs prior consent unless it's strictly necessary to provide the service. Analytics generally isn't considered strictly necessary, but some regulators set out exemption conditions for tools that do only aggregate measurement with no cross-site tracking.
• United States. Most states use an opt-out model rather than prior consent. Some, such as California, have explicit opt-out requirements for selling or sharing personal information.
• Mainland China. The Personal Information Protection Law requires notice and consent before processing personal information. App store reviews for apps and mini programs are especially strict and usually require that nothing is collected before the user accepts the privacy policy.

If most visitors are in one region, the question is much simpler. If they're spread across several, you'll handle each region separately.

Question 2: what does your analytics collect?

"Website analytics" covers very different methods:

The top row (cookies) and the bottom row (account linking) are the most likely to need consent. Cookieless anonymous analytics in the middle faces much lighter requirements in many regions.

PathClue defaults to the third row: no cookies, no local storage, IP addresses not stored, the visitor identifier computed by the collector. Only identity mode links data to signed-in accounts.

Question 3: what else is on your site?

This one is often overlooked. Even if your analytics sets no cookies at all, your site may also have:

• Conversion pixels from ad platforms
• Social share buttons or embedded posts
• Third-party widgets such as video players or chat

Those may well set cookies or track. In that case your site as a whole may need a consent banner whatever your analytics does.

So before deciding, list every third-party script on your site.

Putting the three together

Some common situations, as starting points for the conversation with legal:

Situation A: visitors mainly in the US or other regions without prior-consent rules, cookieless analytics only, no ad pixels. In most cases no banner is needed for analytics; describe it in your privacy policy.

Situation B: many visitors from the EEA and UK, cookieless analytics only, no other tracking. Whether a banner is needed depends on how local regulators view such tools; some set out clear exemption conditions. This is the case where legal advice matters most.

Situation C: ad pixels or other cookie-setting tools on the site, with European visitors. A consent banner is almost certainly needed, and analytics can sit in the same consent flow as everything else.

Situation D: apps or mini programs in mainland China. Nothing should be collected before the user accepts the privacy policy.

If consent is required, what happens to analytics?

In PathClue you can require consent by region. When consent is required and the visitor hasn't given it (or declined):

• The visit drops to the most anonymous level: the identifier changes daily and nothing persistent is kept.
• Pageviews and custom events are still recorded, so traffic trends, sources and pages reports stay complete.
• Features that identify individuals — autocapture, sign-in linking — don't run.

So requiring consent doesn't make your reports go blank. That's very different from cookie-based analytics, which usually loses the visit entirely once a visitor declines.

For apps and mini programs in mainland China, China mode makes the SDK wait: no initialisation and no data until consent is granted.

Configuration details are in the help center: Consent rules by region.

In short

There's no universal answer to whether analytics needs a banner. But you can answer three questions first: where are your visitors, what does your analytics collect, and what else runs on your site. With those answered, the discussion with legal becomes far more concrete, and it's easier to land on something that is compliant without pestering visitors more than necessary.

Related articles

Privacy & compliance·Aug 28, 2026·4 min read

Cookieless visitor counts: how accurate are they?

Does cookieless analytics over- or under-count? Where it makes almost no difference, where you should read the numbers differently — with concrete examples.

Read article

Product notes·Oct 16, 2026·3 min read

Why bot traffic gets its own report

By default we take identified bots out of your human reports rather than dropping them or mixing them in. The three reasons behind that, and what it means for your numbers.

Read article

Playbooks·Oct 14, 2026·5 min read

Checkout drop-off: a seven-step investigation from data to fix

Plenty of add-to-carts, not many payments. A checklist to work through in order — rule out technical problems first, then find which step, which visitors and what cause.

Read article