So do you need a cookie banner?

Article 5(3) of the ePrivacy Directive doesn’t contain the word “cookie.”

That’s not a technicality. It’s why most of what you’ve read about consent banners is aimed slightly to the left of the actual rule, and why “we’re cookieless, so you don’t need a banner” is a weaker sentence than the people saying it think.

We sell an analytics tool, so everything below is either a quote from the rule or a link to the regulator - and we’ll say plainly where our own product doesn’t clear a bar.

What the rule says

Directive 2002/58/EC, Article 5(3), as amended in 2009. This is the sentence everything hangs on:

“Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent… This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication…, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.”

(legislation.gov.uk, checked September 3, 2026.)

Three things to take from that.

The trigger is “information,” not “personal data.” The rule bites even when nothing you store is personal. A random number counts.

It’s technology-neutral. Cookies, localStorage, sessionStorage, IndexedDB, cache tricks - none of them are named, because it’s about the act of storing, not the mechanism.

There are two exemptions: storage needed to carry the communication, and storage strictly necessary for a service the user explicitly asked for.

Why “strictly necessary” doesn’t cover analytics

Analytics fails the second exemption on the same word every time: explicitly requested.

Your visitor asked for the article. They didn’t ask to be counted. So under the classic EU reading, measurement has never fitted exemption two, no matter how privacy-respecting the tool is. A vendor telling you otherwise is arguing a position, not reporting a rule.

Cookieless doesn’t settle the question

“Cookieless means no banner” rests on a claim that Article 5(3) is never engaged at all, because nothing is written to and nothing is read from the device.

The European Data Protection Board tightened that in Guidelines 2/2023 on the Technical Scope of Article 5(3), version 2.0 adopted October 7, 2024. Their reading is broad:

• Storage and access “do not need to be both present” - either one engages the rule (§30).
• JavaScript that “instructs the browser of the user to send asynchronous requests with the targeted information” is access, and “clearly falls within the scope” (§33).
• A hashed unique identifier doesn’t escape it, because the browser was instructed to send it (§63).
• The storage medium is irrelevant - hard disk, SSD, RAM, even CPU cache (§38).

But the EDPB also says the thing every summary leaves out. From §56: “the applicability of this article does not systematically mean that consent needs to be collected… in each case it would have to be assessed if a consent is needed or whether an exemption under Article 5(3) ePD could apply.”

So the question isn’t does this tool touch the device. It’s what is it for, and can anyone be identified with it. Which is how the UK now writes it down.

The UK analytics exemption

The Data (Use and Access) Act 2025, section 112 and Schedule 12, inserted a new Schedule A1 into PECR, in force February 5, 2026 (the statute, the commencement regulations). Biggest change in this area in years, and barely reported.

Paragraph 5 exempts storage or access where the sole purpose is to “collect information for statistical purposes about how the service is used with a view to making improvements,” the information isn’t shared, the user gets “clear and comprehensive information” about the purpose, and the user has “a simple means of objecting, free of charge,” and doesn’t object.

The ICO calls it the analytics exception and draws the boundary in one sentence: “It is about how your service is used, not about who uses it.” Their published examples (ICO guidance on storage and access technologies, last updated April 29, 2026):

Two conditions vendors skate past, and we won’t. The exemption requires you to explain the analytics in your privacy notice, and it requires a simple free way to object - a toggle that’s on by default is fine, browser settings alone are not. A site running “exempt” analytics with no disclosure and no opt-out isn’t covered by the exemption it’s claiming.

Third-party tools are explicitly allowed - but your provider “must be a processor, not a joint controller,” must use the data only to improve your service, and must not pool it with anything else.

France uses self-assessment

CNIL’s audience-measurement exemption under Article 82 of the loi Informatique et Libertés is narrower. A tracker’s purpose must be strictly limited to measuring that one site, for the publisher alone, producing anonymous statistics only - and it must not cross-reference with other processing, pass non-anonymous data to third parties, or let a person be followed across sites or apps (CNIL, July 4, 2025).

Their self-assessment tool is unusually specific: referrer limited to host or domain; no CRM or campaign IDs imported from URLs; browser and OS reduced to major version; and if a fingerprint is used at all, the hash must carry a site-specific component and a time component, so it can’t follow anyone anywhere or for long.

Nobody can say “CNIL-approved” any more. CNIL retired its published list of evaluated tools in July 2025 and replaced it with self-assessment, and it forbids the phrasing outright - you may not present a solution as « certifiée » or « validée par la CNIL ». A vendor claiming it is describing a program that no longer exists.

GDPR doesn’t go away either

Two rulebooks. Clearing ePrivacy doesn’t clear GDPR, and what GDPR-friendly analytics means is written out on its own page.

If a tool processes an IP address, even for a moment, that can be personal data - Breyer (C-582/14, October 19, 2016) held a dynamic IP is personal data for a site operator if that operator has legal means to identify the visitor using information held by the access provider. Conditional, not blanket. Where it applies you need an Article 6 basis, and legitimate interest under 6(1)(f) is the normal answer, which brings a balancing test and a right to object.

Privacy-friendly analytics doesn’t make GDPR stop applying. It makes it apply to a much smaller, shorter-lived pile of data with an easier case to make.

What Feasible stores

No cookies. None, ever, for visitors on a tracked site.

We do use localStorage, for two things. Every event is written to a small retry queue before the request goes out, so a dropped connection doesn’t become a missing pageview; a successful response deletes it. And if you set feasible_ignore yourself, we skip you. That’s storage on the device, and under Article 5(3) storage is storage. We’re not going to pretend it isn’t there to get a cleaner sentence.

No visitor identifier is stored on the device at all. The visitor hash lives on our side: a daily-rotating SipHash of user agent, IP and domain. The salt changes every UTC day and the old one is unrecoverable, so nobody - us included - can connect Tuesday’s visitor to Wednesday’s. It’s site-scoped, so it can’t follow anyone between sites.

It’s pseudonymous, not anonymous. We won’t use the second word. Pseudonymous data is still personal data, and a vendor who upgrades that adjective is telling you something about the rest of their claims.

The raw IP never reaches disk. Geolocation and hashing happen in the ingest tier and the address is discarded before anything is written. Geolocation is a local lookup against DB-IP Lite - country, region, city, no network call per pageview, nothing finer.

Where we don’t clear a bar: we’re a US company in Oregon with no EU region, and transfers run on standard contractual clauses through our DPA. CNIL’s own suggested alternative for anyone worried about transfers is a tool that makes none, and that isn’t us. If EU-only hosting is your requirement, buy from someone who has it.

Do you need one?

Most sites running Feasible won’t need a consent banner. The UK now has a statutory exemption written for this, and the practices it describes are the practices we implement. Elsewhere in the EU it’s a strong case rather than a settled one.

Do two things either way, because both are cheap and both are conditions of the UK exemption: put a plain sentence in your privacy policy saying you measure traffic and how, and give people a simple free way to opt out.

And if you’re somewhere strict, or regulated, or you’d just rather be certain - ask your own lawyer. We’re an analytics company, not your counsel, and nothing here is legal advice. Every rule above is linked so they can start from the source instead of from us.

More on the mechanism in the docs, and the rest of what we don’t collect is on the privacy page.