Cookies and analytics: what a small site needs and how to ask honestly

Almost every site wants to know which pages people read and where they click. Almost every visitor is tired of cookie banners. Both are fair. Here is how to get useful numbers and still treat visitors as adults, using this site as a worked example.

This is a practical overview, not legal advice. For a business with real risk, check the details with a lawyer in your market.

What a cookie is, and what the rules are really about

A cookie is a small piece of text a site stores in your browser and reads back on the next visit. Login sessions, a cart and a chosen language all work through cookies, and nobody objects to them.

The rules care about something else: storing or reading anything on a visitor’s device that the site does not strictly need to work. Analytics and advertising identifiers are the typical case. It does not matter whether the storage is a cookie, localStorage or a device fingerprint: the law looks at the purpose, not the technology.

What the law says

EU and UK. The ePrivacy Directive (article 5(3)) requires consent before storing non-essential data on a device. The GDPR defines what consent means: freely given, specific, informed and unambiguous. In practice:

• nothing non-essential runs before the visitor answers;
• refusing is as easy as accepting, on the same screen and with the same effort;
• no pre-ticked boxes: the EU Court of Justice ruled on this in the Planet49 case in 2019;
• changing your mind later is as easy as the first answer.

The cost of getting this wrong is real. In 2022 the French regulator CNIL fined Google €150 million and Facebook €60 million because refusing cookies took more clicks than accepting them. The UK follows the same logic under its PECR rules.

United States. There is no general cookie consent law. California’s CCPA and CPRA give people the right to opt out of the “sale or sharing” of their data, which in practice means a “Do not sell or share” link when you use advertising trackers.

Russia and Belarus. Both have personal data laws (152-FZ in Russia, Law No. 99-Z in Belarus) that treat data identifying a visitor as personal data and expect a privacy notice and consent. The details differ and change, so this is where a local lawyer earns their fee.

Google Analytics in the EU

In 2022 several regulators, starting with Austria’s, found that sending EU visitor data to Google Analytics in the US broke the GDPR. The EU–US Data Privacy Framework of July 2023 settled the transfer question for companies certified under it, Google included. Consent before analytics cookies is still required.

Since March 2024 Google also expects Consent Mode v2 for traffic from the EEA: the site tells Google whether the visitor agreed to analytics and to ads, and Google adjusts what it stores. Without it, ad measurement for European visitors stops working.

Three honest ways to count visits

1. Analytics without cookies. Plausible, Fathom, Cloudflare Web Analytics, or PostHog in cookieless mode count pages and sources without an identifier on the device. Several EU regulators, the French CNIL among them, accept such audience measurement without consent under strict conditions. You lose returning-visitor stats and long funnels.
2. A banner with a real choice. You get the full picture from people who agree, and less from those who don’t. This is the only lawful way to run Google Analytics with cookies for EU visitors.
3. A banner with no real choice. A huge “Accept”, a tiny “Settings”, tracking that starts before any click. It annoys visitors and is exactly what regulators fine. Don’t.

A fair banner, as a checklist

• Two buttons of equal weight: allow and decline.
• No analytics or ad scripts load before the answer.
• Plain words about what is collected and why, with a link to the details.
• A permanent link, usually in the footer, to change the choice.
• Declining removes cookies already set.
• The choice is remembered, so the question is asked once.

How this site does it

This site uses two tools: Google Analytics 4 and PostHog.

• Until you answer, Google Analytics does not load at all.
• Until you answer, PostHog runs without cookies. It keeps a random ID in memory only, so it forgets you on the next page.
• If you allow, both tools may set cookies, so I can see returning visits and which pages lead to a conversation.
• If you decline, the cookies they set are removed, and Google Analytics stays off.
• Your answer is stored in your browser’s localStorage under the name consent. Nothing about it is sent to me.

What I look at: which pages and projects people open, how far they scroll and read, which section of the home page they reached, and whether they clicked Telegram or LinkedIn, and from where. Links to my products carry UTM tags, so those products can tell visits from here apart.

What I don’t do: no advertising, no Google signals, no ad personalization, no selling or sharing of data, no recording of what you type.

Change my cookie choice

If you build a product and want the same setup, honest analytics that answer business questions without dark patterns, that is something I can help with.