Short version: you need a cookie banner when you store or access non-essential information on a user’s device (typical EU/UK reading of the ePrivacy Directive and UK PECR). You do not automatically need one because you “do analytics.” SiteLine’s tracker does not set a first-party analytics cookie. If that tracker is the only non-essential storage you were consenting for, the analytics-cookie reason for the banner goes away. If you still run Google Analytics 4, ads pixels, or a cookie-based CRM, the banner stays.
This is not legal advice. National DPAs disagree, and GDPR still applies to the network request even when no cookie is set. Policy: /privacy. Model: /docs/privacy. How many visitors a consent-gated GA4 never counts: how much traffic does a cookie banner cost analytics?
Separate the three questions
1. Do we set a cookie (or localStorage / similar) for analytics?
SiteLine: no, not on your site. Collect uses fetch with credentials: 'omit'. Visitor identity is a server-side daily hash of truncated IP (IPv4 /24, IPv6 /48) plus user agent. See Cookieless tracking explained.
2. Do we process personal data? Yes, in the usual privacy-law sense: URLs, truncated-IP hashes, user agents, country when available. GDPR and the Australian Privacy Act 1988 can still apply. A banner is the wrong instrument for that — a privacy notice is the right one. Consent-free analytics does not mean notice-free.
3. Do other scripts set cookies?
Look at the actual site. WordPress logged-in cookies, Shopify _shopify_y, HubSpot, Intercom, YouTube embeds, Google Tag Manager containers full of floodlight tags — SiteLine cannot see those from our collect endpoint. The hostname allowlist only accepts events from hosts you registered. It does not inventory the rest of your <head>.
If the answer to (1) is no for every vendor, and (3) is truly empty of non-essential cookies, many EU/UK teams drop the analytics banner. If (3) is not empty, keep the banner and stop blaming measurement.
What about the SiteLine app itself?
siteline.tools sets session, CSRF, and theme/sidebar cookies so the product works. Those are not analytics cookies and they are not set on your customers’ domains. Stripe sets its own cookies on Stripe-hosted checkout and billing pages, under Stripe’s privacy policy. Do not copy the app’s cookie table into a client site’s banner and call it “SiteLine analytics cookies.” There aren’t any.
EU, UK, Australia, US — different banners
EEA / UK. ePrivacy / PECR is why banners exist. Cookieless analytics is the lever. GDPR still wants a legal basis and transparency. Some authorities have been sceptical of analytics even without cookies. Read GDPR analytics without a consent banner and do not tattoo “no consent required” on the marketing site without counsel.
Australia. No EU-style cookie rule. The Privacy Act 1988 is about personal information and APP notice. You may still show a banner for EU visitors or because a template came with one. See Analytics and the Australian Privacy Act.
United States. State laws (CCPA/CPRA and cousins) care about sale/share and some tracking, not a pixel-perfect ePrivacy banner. SiteLine does not sell personal information or use analytics for ads. You may still need a “Do Not Sell” story for other vendors.
How to decide in an afternoon
- Load the site in a fresh browser. Note cookies before any “accept.”
- Disable Google Analytics 4 / GTM analytics tags. Reload. See what remains.
- Install SiteLine (/docs snippet, hostname allowlist). Confirm no new analytics cookie.
- Decide per remaining cookie: essential (session, load balancer, CSRF) vs marketing.
- Write the privacy notice: SiteLine / Aglet Technologies, cookieless hash, events sent to SiteLine servers, subprocessors Stripe and Cloudflare, hosting not EU-only. Link /privacy.
- If EU traffic and remaining marketing cookies: keep a banner for those. If not: you may be done with the analytics banner.
A first-party proxy (nginx, Caddy, Cloudflare, Vercel; no managed CNAME in v1) is about ad blockers, not about manufacturing a “first-party cookie” you then have to banner. The proxy still forwards bodies to SiteLine.
Plans are $4.99 / $19.99 / $99.99 USD with a 7-day trial — irrelevant to the legal test, relevant when a lawyer asks who the vendor is and what you pay them.
FAQ
If we use SiteLine, can we delete Cookiebot / OneTrust?
Only if nothing else on the site needs that platform. Consent CMPs exist because of ads, personalisation, and GA4. Removing GA4 and keeping the CMP for Facebook Pixel is normal. Removing the CMP because a blog post said “cookieless” while GTM still fires 14 tags is how you get a complaint.
Does a first-party proxy create a cookie we must declare?
Not in SiteLine’s v1 model: we still do not set an analytics cookie. You might set your own cookies on that domain for other reasons. Proxy docs: /docs/proxy.
Are SiteLine unique visitors “consented users”?
No. There is no consent signal in the tracker. Counts include visitors who never saw a banner. If you need consented-only analytics you are in GA4 + CMP territory, not this product.