pieowlDocs
pieowl.comSign inStart free trial
Do you need a cookie banner?

Do you need a cookie banner?

What Pieowl stores and reads, why EU consent rules can apply without cookies, how the rules differ by country, and which features need your visitors' consent.

View as Markdown

Pieowl sets no cookies, so in many cases you don't need a consent banner for analytics. But "no cookies" doesn't settle it on its own. The answer depends on your country, on the features you turn on and on the other tools on your site.

This page is information, not legal advice. Ask your legal advisor about your own site.

What Pieowl stores and reads

  • No cookies. The script never sets a cookie.
  • Nothing stored on your visitors' devices. No local storage, no session storage, no IndexedDB.
  • IP addresses are never stored. The IP is used to look up an approximate location and to build the visitor ID, then dropped.
  • Visitor IDs reset every day. The ID is a hash of the browser's user agent, the IP, your site and a secret salt. The salt changes every day.
  • No cross-site tracking. The ID includes your site, so the same visitor gets a different ID on every site.
  • Session replay is off unless you turn it on. Text and form fields are always hidden in session replays.

The script does read some things in the browser and send them to Pieowl: the page address and title, the referrer, and the clicks and events you track. See What gets collected and our data policy for the full list.

Why the rules can apply without cookies

The EU rule on devices (ePrivacy Directive, Article 5(3)) covers reading information from a device, not only storing cookies. The EDPB, the board of EU data protection regulators, says a script that makes the browser send information falls under that rule (Guidelines 2/2023, paragraph 33). So the question is not only "are there cookies?" but "does an exemption cover this?". The EU has no single exemption for analytics. Some countries have one.

By country

  • France. The CNIL (the French regulator) lets audience measurement run without consent if it meets its conditions. The main ones: it only measures your own site's audience, for you alone; it produces only anonymous statistics; the data isn't combined with other data or passed on; and it doesn't follow people across sites. The CNIL also expects an opt-out and recommends keeping the data no longer than 25 months. Session replay, revenue and conversion tracking, and campaign (UTM) tracking fall outside this exemption.
  • Netherlands. The law has an exemption for analytics with little or no impact on privacy (Telecommunicatiewet, Article 11.7a).
  • Germany, Poland and Ireland. There is no general exemption for analytics. Germany's regulators give no blanket answer. Poland's law (Prawo komunikacji elektronicznej, Article 399) only exempts what is needed to send a message or provide the service the visitor asked for. Ireland's regulator says analytics needs consent. Ask your advisor. You may need a consent tool: see Consent management.
  • Other countries. Check your own regulator's guidance.

Session replay

Recording what a visitor does needs their consent. When you turn session replay on, keep Record only after visitors agree on in Settings → Site → What Pieowl counts. It's on by default. Pieowl then records nothing until your site calls allowReplay after the visitor accepts in your own consent banner:

js
// Script tag
window.pieowl('allowReplay');

// npm package
pieowl.allowReplay();

Pieowl stores nothing in the browser, so it can't remember the choice for you. Call allowReplay on every page where the visitor has agreed. See Consent management.

Revenue sent from the browser

A purchase() call from the browser links a sale to the visit. That is conversion measurement, and France's exemption doesn't cover it. Treat it as needing consent. Prefer sending purchases from your server or with your payment provider's webhooks: see Revenue attribution.

What you must do anyway

Even where you don't need a banner:

  • Name Pieowl in your privacy policy. Say that you use Pieowl for analytics and what it collects. Our data policy has text you can copy.
  • Sign the DPA. Pieowl processes visit data for you. Our data processing agreement covers that.
  • Keep an opt-out. Give visitors a way to say no, for example a link in your privacy policy. The script's filter option can check their choice.
  • Have a legal basis under GDPR. Most sites rely on legitimate interest for analytics.

Sources