A website without a cookie banner: when you can and how
Cookie banners are so common that they look like a legal requirement for every site. They are not: a banner is needed only if the site uses tracking tools that are not strictly necessary. Here is when you can drop it, what to replace and what the EU rules under discussion would change.
The rule: a banner is needed only for non-essential tracking
In Italy the reference points are article 122 of the Privacy Code, which transposes article 5(3) of the EU ePrivacy Directive, and the Italian data protection authority's Guidelines on cookies and other tracking tools, adopted on 10 June 2021 and published in the Official Journal on 9 July 2021 (Garante Privacy).
- Essential cookies (session, login, cart, chosen language): no consent, so no banner.
- Profiling or marketing cookies and tools, first or third party: consent is needed before they run, so a banner is needed.
- Analytics: it depends on how they are configured, and this is where most of the game is played.
Dropping the banner does not drop the privacy notice: the privacy policy is still required and must say which tools the site uses.
Analytics that do not need consent
The Italian authority treats analytics like essential cookies, and so allows them without consent, only if they meet four conditions (Garante Privacy):
- they cannot single out an individual user: for instance by masking at least the last part of the IP address;
- they only produce aggregate statistics;
- they cover a single site, without following users across different sites;
- if the provider is external, it does not combine the data with other information or pass it on.
Google Analytics 4 in its standard setup does not meet these conditions, because Google also uses the data for its own purposes: it needs consent. Tools built for aggregate measurement do qualify, such as self-hosted Matomo configured to minimise data, Plausible, Umami or Simple Analytics. They measure visits, page views, referrers and conversions without building a profile of the visitor.
Something is lost: the path of a single user over time. For a business website, though, knowing how many people arrive, from where and how many fill in the contact form is almost always what matters. And the data is complete, not halved by everyone who clicks "Reject".
The banner is usually demanded by your guests
On most sites we review, the site's own cookies are few and harmless. What makes a banner necessary are the external services embedded in the pages.
| Service | Why it needs consent | Alternative |
|---|---|---|
| Google Analytics 4 | Data also used by Google | Minimised or cookieless analytics |
| YouTube or Vimeo videos | The player sets cookies as soon as the page loads | Static preview, the player starts on click |
| Google Maps | Same as videos | Map image with a link, or load on click |
| Google Fonts and external fonts | Every visit sends the visitor's IP to an external server | Fonts hosted on your own server |
| reCAPTCHA | Analyses visitor behaviour | Hidden anti-spam field or captchas that do not track |
| Meta Pixel, Google Ads, LinkedIn | Advertising profiling | None: if you need them, you need the banner |
If the site does not run advertising with remarketing, you can almost always get down to zero tools that need consent. This site works that way too: fonts on our own server and no profiling cookies.
"Cookieless" does not mean "consent-free"
The EU rule is not only about cookies: it covers any way of reading or storing information on the user's device. The European Data Protection Board made this clear in its 2024 guidelines: tracking pixels, parameters in page addresses, browser local storage and, in some cases, IP-based tracking are all in scope (EDPB).
The most sensitive case is fingerprinting, which recognises a browser from its configuration without storing anything. For the Italian authority it follows the same consent rules, and it is more invasive than cookies because users cannot delete it (Garante Privacy). Replacing cookies with a technique that does the same thing does not remove the obligation: the means change, the purpose does not.
The same goes for server-side tracking. Moving data collection from the browser to a server controlled by the site improves speed, data quality and control over what reaches Google or Meta. But if the purpose is advertising, consent is still required.
If you advertise online, the banner stays
Anyone investing in Google Ads or Meta Ads with remarketing needs consent. The goal becomes a well-built banner that loses as little data as possible.
- 01
Real blocking before consent
Pixels and tags only run after the user says yes, including those added by the page builder or loaded later.
- 02
Rejecting as easy as accepting
The Italian authority requires that closing the banner with the X counts as a refusal, and that after a refusal the banner does not come back for 6 months, barring significant changes (Garante Privacy).
- 03
Google Consent Mode v2
It tells Google the consent status. For users who refuse, Google models conversions without advertising cookies.
- 04
Withdrawal that works
When users change their mind, the cookies of the withdrawn category must be deleted and the scripts stopped, not just hidden.
For these sites we built CF Consent, our own consent manager: a single file installed on the site, built on the Italian authority's guidelines and compatible with Cookiebot.
The EU reform: what changes and when
On 19 November 2025 the European Commission proposed the Digital Omnibus, which among other things moved cookie rules into the GDPR and let users state their preferences once, from the browser (European Parliament).
On 21 October 2026 the member states approved the Council's position, which changes the proposal considerably (PPC Land):
- the rules stay in the ePrivacy Directive, in a rewritten article 5(3), and the automatic browser signal is gone;
- the exemption for audience measurement by the site itself becomes explicit, with anonymous aggregate data that is neither shared with nor combined by third parties;
- after a refusal, consent for the same purpose may be asked again after at least 4 months;
- the new rules would apply 24 months after transposition by member states.
The European Parliament has not yet voted on its position and final negotiations have not started. In practice the direction confirms what the Italian authority already allows today: aggregate analytics without consent, advertising tracking only with consent. Waiting for the reform before fixing your site is not worth it.
In practice
| Type of site | Banner | What to do |
|---|---|---|
| Brochure site without paid campaigns | Can be dropped | Minimised analytics, self-hosted fonts, videos and maps on click, no reCAPTCHA |
| Site running Google Ads or Meta Ads | Needed | Compliant banner, real script blocking, Consent Mode v2 |
| E-commerce | Almost always needed | Separate what the shop needs from what advertising needs |
Does your site need a banner?
Send us your site's address. We will tell you what it installs and why, what can be removed or replaced to do without the banner and, if a banner is needed, how to make it compliant without losing data for nothing.
How we wrote this article
At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them. This article is for information only and is not legal advice.
Frequently asked questions
Is a cookie banner mandatory for every website?
No. It is needed only if the site uses non-essential cookies or other tracking tools, such as profiling, advertising or analytics that are not minimised.
Can I drop the banner with Google Analytics 4?
Not in its standard setup: Google also uses the data and consent is required. To drop the banner you need minimised or cookieless analytics.
Is cookieless analytics always exempt?
Only if it measures in aggregate and does not identify or follow individual users. A technique that recognises visitors without cookies, such as fingerprinting, still needs consent.
Do I still need a privacy policy without a banner?
Yes. The privacy notice is still required and must explain what data the site processes and with which tools.
Will the Digital Omnibus get rid of banners?
Not soon. The position approved by the Council in October 2026 keeps consent for tracking and Parliament has not voted yet. If adopted, the new rules would apply after a transposition period.
Sources
- Garante Privacy, Linee guida cookie e altri strumenti di tracciamento, 10 June 2021
- EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0
- European Parliament, Legislative Train: Digital package
- PPC Land, EU Council agrees 4-month cookie re-ask wait for Digital Omnibus talks