A Website without a cookie banner This is possible if no storage access requiring consent, trackers, or uncontrolled third-party services are activated on the first access. The decisive factor is not whether technically necessary Cookies These factors may occur. Crucial are the purpose, technical necessity, processed data, recipients, and storage access on the end device.
In over 20 years of web development, I've frequently encountered the same root cause in SMEs: the banner itself isn't the real problem, but rather a cluttered technical foundation. This includes outdated analytics scripts, automatically loaded maps, social media feeds, or externally retrieved fonts. A consent banner can manage these data flows, but it doesn't eliminate unnecessary integrations.
The absence of a cookie banner is not proof of data protection. However, a website designed with data minimization in mind can function without access requiring consent and therefore does not need a consent banner.
When is a website possible without a cookie banner?
A website without a cookie banner is generally possible if only technically necessary functions are active on the first visit and no trackers requiring consent or similar technologies are used. This requires examining all storage access, external resources, and data flows.
The European basis is Article 5(3) of the ePrivacy DirectiveThe directive generally requires prior, informed consent when information is stored on or read from the end device. Exceptions exist, in particular for technically necessary processes. Therefore, the rule does not only apply to classic browsers.Cookies, but also comparable technologies.
In Germany, the former TTDSG 2024 was renamed TDDDG. Section 25 of the TDDDG generally requires consent for storing information on terminal equipment and for accessing information already stored. Exceptions apply to message transmission and access that is strictly necessary to provide an explicitly requested digital service.
For Italian and South Tyrolean businesses, national regulations and the interpretation of the Italian Data Protection Authority (Garante per la protezione dei dati personali) are also relevant. The Italian data protection authority specifies in its guidelines, among other things, the requirements for profiling trackers, privacy-friendly default settings, and the design of consent banners.
A general GDPR checklist is therefore insufficient for a German-Italian website. Examine the specific technical implementation and the national requirements for the respective market. The following checklist serves as a practical guide but does not replace legal advice in individual cases.
Cookie banners, consent banners, and privacy policies are different.
To evaluate a website without a consent banner, you need to separate three levels:
- Cookie banner: The term usually refers to the visible indicator or selection mask for CookiesOther access attempts to the end device may also be legally relevant.
- Consent banner: A consent banner manages consent for specific data processing activities and services. Functions requiring consent must remain blocked until valid consent is given.
- Data protection statement: The privacy policy provides information about data types, purposes, recipients, legal basis, storage period, and rights. This obligation to provide information does not lapse even if a banner is not required.
A website without a consent banner still needs a privacy policy that reflects its actual technology. Contact forms, server logs, hosting, email sending, or job applications can process personal data without automatically requiring a cookie banner.
Avoiding cookie banners: the check order for SMEs
You can't reliably avoid a cookie banner simply by removing a plugin. First, you need to determine what the website is technically doing. I recommend the following order for this:
- 1. Inventory services: Capture hosting, forms, analytics, videos, maps, fonts, chats, newsletters, payment services, appointment booking, social media content and marketing scripts.
- 2. Record the purposes: Document for each service what specific task it performs.
- 3. Test memory accesses: Check which Cookies, local storage objects, pixels, scripts or similar identifiers become active before consent is given.
- 4. Document data flows: Document which data is transferred to which recipients, where the processing takes place and which subcontractors are involved.
- 5. Assess necessity: Separate technically necessary Cookies and functions of comfort, analysis and marketing services.
- 6. Check embeddings: External videos, maps and posts may not transmit data uncontrolled before the necessary consent has been obtained.
- 7. Check the documentation: The privacy policy, data processing agreements and the internal service list must correspond to the actual configuration.
- 8. Check changes: Repeat the technical check after each new integration.
You can find a more in-depth explanation of this approach in my article on Privacy by Design for SMEs . Data protection is planned before the tool selection and technical implementation, not just shortly before publication.
Data protection by design with btlabs Core
At btlabs Core, we prioritize data privacy by design . The core system isn't first extended with advertising and tracking services, only to then have a complex consent mechanism added on top. The data-minimalist basic configuration reduces avoidable data flows from the outset.
The planned base includes:
- No US ad trackers in the basic system,
- Data-efficient statistics instead of detailed user profiles,
- controlled embeddings for external media,
- EU hosting as part of infrastructure planning,
- local fonts instead of automatic retrieval from external font servers,
- a sleek architecture with fewer technical dependencies,
- Data sovereignty and traceable data flows.
This architecture provides a suitable foundation for a website without a cookie banner, but it's not a blanket GDPR guarantee. As soon as you later integrate a marketing pixel, an external chat, or another extension, the assessment will need to be updated. I explain how the system is structured as a digital foundation in the article about btlabs Core for SMEs.
Why EU hosting alone is not enough
EU hosting is a useful part of the infrastructure, but it doesn't answer every data protection question. Even with a server location in the EU, a transfer to a third country can still occur if personal data is disclosed to, or made accessible from, a legally independent company in a third country.
The European Data Protection Board's Guidelines 05/2021 focus on the actors involved, the disclosure of data, and the recipient's location when it comes to international data transfers. Therefore, in addition to the server location, providers, subcontractors, support access, and technical recipients must be examined.
EU hosting is one component, not a GDPR certificate. A complete assessment also includes data minimization, security, legal bases, information obligations, contracts, deletion periods, and data subject rights.
Practical example: Website of a South Tyrolean SME
A family-run craft business from the Eisack Valley operates a website that has been expanded over several years. On the first visit, an analytics tool is launched. Simultaneously, a YouTube video, Google Maps, a social media feed, a marketing pixel, and fonts are loaded from external servers.
Previously: many services, unclear data flows
- Analysis scripts start before the selection in the banner.
- Video, map and social media feed transmit data to several third-party providers.
- The company cannot fully identify the recipients.
- The banner lists categories, but does not block every external connection.
- The privacy policy does not fully reflect the technology used.
Such a setup is more difficult to document and maintain. Additional scripts can also increase loading times, dependencies, and the likelihood of errors. At the same time, the organization collects data that it may not need for its decision-making.
Afterwards: limited and documented processing
- The web statistics only record the necessary key figures.
- Fonts and key design elements are delivered locally.
- The video initially appears as a preview image and only loads the external service after required approval.
- A textual description of the route replaces the automatically loaded map; an external map remains optional.
- Social media posts are not automatically loaded by the platform.
- Recipients and data flows are documented.
- The privacy policy reflects the actual system.
The company retains its services, contact information, references, and location details. However, the website without a cookie banner transmits less data to external platforms on the first visit.
Which extensions need to be re-examined?
A single new integration can change the evaluation of a website without a consent banner. This particularly affects external media and communication services.
- YouTube or Vimeo: Directly embedded videos can establish connections to the provider upon loading. A preview image with permission or a locally hosted alternative prevents immediate access.
- Google Maps: A directly embedded map integrates an external provider. Textual directions or controlled embedding reduces automatic data flows.
- Social media feeds: Live feeds and platform plugins are technically different from a normal link to a profile.
- Chat tools: Chat functions can send identifiers, conversation content, and technical metadata to external providers.
- External forms: Embedded forms can transmit data as soon as they load, not just when they are submitted.
Transactional and advertising services also require a separate review:
- Newsletter: Forms, shipping services, confirmation processes and success measurement must be evaluated separately.
- Appointment booking: External booking systems often process contact and appointment data and can load additional resources.
- Payment services: A shop processes different data than a purely informational website and requires adapted documentation.
- Marketing pixel: Advertising, retargeting and profiling technologies are typical trackers that require consent.
- Fonts: Externally loaded fonts create connections to external servers. Locally loaded fonts avoid this request.
If your business model requires detailed campaign measurement, a properly configured consent process makes more sense than simply foregoing banners altogether. I explain the differences between Matomo, GA4, and consent in more detail in my article on GDPR tracking for SMEs.
Data-saving statistics for a website without a cookie banner
Many smaller businesses don't need personalized user profiles. Often, page views, popular content, general traffic sources, and simple goal actions are sufficient to further develop a website.
Data-minimizing statistics serve a limited purpose, reducing identifiers and avoiding unnecessary links. However, "cookie-free" does not mean "without obligations." Even without Cookies IP addresses, device information, URLs or other technical data may be processed.
With Matomo, the data protection assessment depends on the configuration. The configuration guide from the French CNIL mentions, among other things, the hosting model, IP anonymization, and the avoidance of third-party providers.Cookies and cross-domain tracking, as well as the deactivation of additional personal functions.
Matomo is therefore neither generally consent-free nor automatically problematic. Check which functions are active, whether Cookies It explains which data is stored and who can access it. I explain further options in my guide to... cookie-free statistics for SMEs.
This way, the website remains data-efficient without a cookie banner.
A website without a cookie banner is not a permanently guaranteed state. New features can change storage access, recipients, and legal basis. Therefore, responsibility for technical changes must be clearly defined.
- Before publication: Conduct a technical inventory, a test of storage accesses, and acceptance testing of all third-party providers.
- With each expansion: Check the purpose, provider, data types, storage access, recipients and hosting.
- Before activation: Decide whether consent is required and how the service will be blocked until then.
- After integration: Try the website again with a fresh browser profile.
- Update documentation: Adapt the privacy policy, service list, and relevant contracts.
- Check regularly: Schedule a data protection and technology audit as a regular maintenance step.
- Identify responsibilities: Define who will release new services and document the technical review.
In our website strategy and technical implementation, we don't treat data protection as an afterthought. The choice of service simultaneously impacts data protection, loading time, dependencies, maintenance effort, and data sovereignty.
FAQs
Is it possible to use Matomo without a cookie banner?
Matomo can be considered in a restricted and data-minimizing configuration without prior consent. The crucial factors are... CookiesIP processing, hosting, activated features, data linking, and recipients. The product name alone does not answer the question.
Does Google Analytics require consent?
For typical Google Analytics configurations, you should assume prior consent, especially if identifiers, cross-device analysis, or links to advertising services are used. The complete setup and applicable national regulations are decisive.
Are YouTube and Google Maps allowed without banners?
A standard link to YouTube or Google Maps is technically different from a directly loaded embed. If the embed transmits data upon page load or triggers storage access requiring consent, it must be blocked until permission is granted or replaced with a local alternative.
Are local fonts and EU hosting sufficient?
No. Local fonts and EU hosting reduce certain external data flows, but they do not replace the review of analytics, forms, recipients, support access, and third-party providers. Server location is only one part of the GDPR assessment.
Do I need a privacy policy if I don't have a cookie banner?
Yes. Even a data-efficient website regularly processes technical data about hosting, server logs, security measures, or contact forms. The privacy policy must describe this processing in a clear and accurate way.
What happens if a marketing service is added later?
Each new integration can change the existing assessment. Before activation, you must review storage access, data flows, recipients, and purpose, and add an effective consent process if necessary.
Can a professionally designed banner be technically flawed?
Yes. A banner fails to fulfill its purpose if services requiring consent load beforehand, if opting out is made unnecessarily difficult, or if the selection has no technical effect. The decisive factor is the website's behavior.
Who is responsible for the website?
Data protection responsibility generally lies with the controller, usually the operating company. Developers, hosting providers, and other service providers must fulfill their contractual and technical obligations, but do not automatically assume overall responsibility.
Is a website without a cookie banner automatically GDPR compliant?
No. A missing banner says nothing about information obligations, forms, data security, contracts, deletion periods, or data subject rights. GDPR compliance requires a complete assessment of all processing activities.
Conclusion: Implementing a website without a cookie banner is feasible.
If you want to avoid a cookie banner, start with the services, purposes, and data flows. Remove unnecessary trackers, replace uncontrolled third-party providers, use local resources, and only load external content in a controlled manner.
btlabs Core provides a data-efficient technical foundation for this. Whether a website can remain permanently functional without a cookie banner depends on the specific configuration and any subsequent extensions. Therefore, only process data that is necessary for a verifiable purpose and provides a concrete benefit to the business and its visitors.
Sources
- Directive 2002/58/EC, Article 5(3) — EUR-Lex (2002, amended 2009)
- Section 25 Telecommunications-Digital Services-Data Protection Act — Laws on the Internet (current version)
- Guarantee for the protection of personal data: guidelines on Cookies and other tracking tools (2021)
- European Data Protection Board: Guidelines 05/2021, Version 2.0 (2023)
- CNIL: Matomo Analytics – Exemption, Guide de configuration (2023)
