GDPR-compliant analytics without a consent banner

We have come to believe that any audience measurement requires a cookie banner. That is false. A banner is only mandatory when a service reads or writes information on the user’s device for purposes that are not strictly necessary for the requested service. A well-designed analytics tool can therefore do without one entirely. Here is the legal framework, explained simply, and how Takt fits into it.

The principle of Article 82

In France, the rule comes from Article 82 of the Data Protection Act, which transposes the ePrivacy directive. The principle is this: storing or reading information on a user’s device requires their prior consent. The law does, however, provide two important exceptions.

The first covers actions whose “exclusive purpose is to enable or facilitate electronic communication.” The second, the most useful here, concerns anything that is “strictly necessary for the provision of an online communication service expressly requested by the user.” In other words: if a cookie is indispensable to the service the person is actively asking you for, it is exempt from consent.

The key word is strictly. The exemption does not cover what is merely convenient or commercially useful: it covers what the requested service could not work without. A session cookie that keeps a user signed in, a cookie that secures authentication, a shopping-cart cookie are classic examples.

What the CNIL says about audience measurement

The CNIL has clarified how this principle applies to audience measurement. In its guidelines, it accepts that certain statistics tools may be exempt from consent, under strict conditions: the measurement must serve only the production of anonymous statistics for the publisher, the data must not be cross-referenced with other processing or passed to third parties, and the system must not allow the overall tracking of a person’s browsing across different applications or websites.

The logic is consistent: it is not the act of “measuring” that triggers the consent requirement — it is tracking. An audience counter that merely aggregates visits, with no persistent identifier and no profile, does not carry the privacy intrusion that consent is meant to protect against.

Why Takt shows no banner

Takt was built to stay on the right side of this line. The measurement script you embed sets no cookie on your visitors’ devices and reads no information from their terminal. On the visitor side, then, there is no access to the device that could trigger the Article 82 obligation at all.

Measurement relies on non-identifying data — URL, referrer, country derived from the IP (never stored), device type and browser — aggregated into statistics. No persistent identifier, no digital fingerprint, no cross-referencing with other processing, no tracking from one site to another. The data is neither sold nor shared for commercial purposes. This is exactly the profile the CNIL’s guidelines describe as eligible for exemption.

That leaves only the platform’s own cookies: takt_session, which keeps you signed in to the dashboard, and takt_oauth, a temporary cookie that secures sign-in through a third-party provider. They concern only you, the publisher, never your visitors, and they are strictly necessary for the service you request — signing in to your workspace. As such, they fall under the Article 82 exemption and therefore call for no banner.

Compliance by design

The result is compliance achieved through architecture rather than through a consent window. You have no module to integrate, maintain or document; your visitors face no pop-up; and your statistics are not skewed by refusals, because there is nothing to refuse. The cookie banner was never an end in itself: it is merely the consequence of a technical choice — the choice to track. By not tracking, you spare yourself the banner and, along the way, honour the spirit of the GDPR.