Teams search for “GDPR analytics without a consent banner” when the banner is crushing conversion and Google Analytics 4 is the reason it exists. Two different EU instruments get mashed together in that sentence.
The ePrivacy Directive (and national laws that implement it, plus UK PECR) is what usually forces a banner for analytics cookies and similar storing/accessing of information on a device. The General Data Protection Regulation (GDPR) is about processing personal data. You can avoid an analytics cookie and still process personal data. You can also run cookieless analytics and still need a banner because something else on the page sets cookies.
SiteLine’s tracker does not set a first-party analytics cookie. Collect uses credentials: 'omit'. Unique visitors are a daily hash of truncated IP (IPv4 /24, IPv6 /48) plus user agent plus a salt you cannot see. Raw IP is not stored on the event. That design is aimed at the cookie/banner problem. It is not a claim that SiteLine is “GDPR compliant,” that the processing has no legal basis requirement, or that Aglet Technologies hosts only in the EU.
This article is product explanation, not legal advice. Binding policy: /privacy. Mechanics: /docs/privacy.
The banner is usually about cookies, not “analytics”
Consent banners exploded because vendors stored identifiers on the device. Google Analytics 4’s _ga / _ga_* cookies are the textbook case. The Court of Justice of the European Union’s Planet49 line of cases, and guidance from the European Data Protection Board (EDPB) and national DPAs, treat non-essential cookies as requiring prior consent — not a pre-ticked box, not “by using this site.”
If your only analytics identifier lives in a cookie, removing the cookie can remove the ePrivacy trigger for that tool. That is why cookieless tools (SiteLine, and others such as Plausible or Fathom) are sold against GA4.
If you still load Meta Pixel, Google Ads, Hotjar, or a cookie-based A/B test, you still have a banner problem. SiteLine does not scan your tag manager for you. See Do I need a cookie banner for analytics?.
GDPR still applies to the request
A pageview POST to SiteLine is processing. The payload includes URL, path, hostname, referrer, event name, optional properties, UTMs, derived device/browser/OS, and country when geography headers exist. The visitor id is a hash, not a name — but hashes of truncated IP and user agent are not automatically “anonymous data” under GDPR Recital 26. Many DPAs treat IP addresses as personal data even before truncation.
So you still need:
- Transparency — name SiteLine / Aglet Technologies in the privacy notice. Link /privacy.
- A legal basis — often legitimate interests for strictly necessary-style audience measurement, in jurisdictions and readings that accept that for this kind of tool. Some DPAs have been stricter about analytics even without cookies. Your DPO decides; we will not pretend a blog post is an Article 6 analysis.
- A story on transfers — events go to SiteLine servers. Stripe and Cloudflare are subprocessors. Hosting is not marketed as EU-only. Standard contractual clauses may be relevant. See EU analytics after Schrems.
Consent-free analytics is a cookie-consent phrase, not a GDPR-exemption phrase.
What SiteLine does on purpose
No analytics cookie on the customer site. The siteline.tools app still uses session, CSRF, and theme/sidebar cookies so you can log in. Those are not set on your product domain.
Truncation then hash, daily salt. Same network tomorrow is a different visitor id. That limits the “track a person for a year” use case GA4 is good at and privacy reviewers hate.
Hostname allowlist and bot filter. Stops trivial flooding of a public site id and keeps crawlers out of quota.
Retention you can write down. Analytics while subscribed (plans $4.99 / $19.99 / $99.99 USD, 7-day trial) plus 30 days’ grace, then purge. Search Console imports while the account exists.
Credential-less collect. fetch + credentials: 'omit' so a SiteLine login cookie is not piggybacked onto a third-party collect. More in Cookieless tracking explained.
What “without a consent banner” does not cover
It does not cover identified product analytics after login (you already have a user). It does not cover session replay or marketing pixels. It does not move processing into the EU. A first-party proxy (nginx, Caddy, Cloudflare, Vercel — customer-configured, no managed CNAME in v1) can reduce ad-blocker loss; it does not keep payloads off Aglet’s servers.
National DPAs disagree with each other. The CNIL, the Austrian DSB, the Dutch AP, and the ICO have not issued a single joint “cookieless SaaS analytics is always legitimate interests” memo. If you operate in a strict member state, get advice for that state.
Contact [email protected] for how the product works. Do not ask us to stamp your DPIA.
FAQ
Is SiteLine GDPR compliant?
We do not sell that phrase. SiteLine is a cookieless tracker with documented truncation, hashing, subprocessors (Stripe, Cloudflare), and retention. Whether your use is lawful under the GDPR is your assessment. Policy: /privacy.
If there is no cookie, is there no personal data?
No. URLs, truncated IPs (even if only used inside a hash), user agents, and country can still be personal data. Cookieless is about not storing an identifier on the device. Read IP anonymization vs cookieless analytics.
Can we hide the banner for EU visitors only and keep GA4 for the US?
Many sites do that. It is a geo-gated consent implementation, not a SiteLine feature. If GA4 still runs in the EEA it still sets cookies. If SiteLine is the only analytics in the EEA, the banner question follows the rest of that region’s stack, not GA4’s.