GDPR and ePrivacy

There is an unavoidable tradeoff between complete, accurate analytics and respecting EU privacy rules. To be compliant under ePrivacy, consent is generally required before storing anything on the user's device for analytics purposes. That commonly means a cookie banner and explicit consent before you can track the visit. You end up with partial analytics for a non-representative sample, then make critical marketing decisions on incomplete data. In computer science, we call this garbage in, garbage out.

There are cookieless, privacy-friendly analytics services like Plausible that don't need cookie banners or consent. But they can only track sessions over a single day, which is much less useful for B2B or subscription businesses where users often take many weeks to make a purchase. The problem is you sacrifice the accuracy of your analytics in the entire world to be compliant with European regulation. For most companies, that trade-off doesn't make sense.

RevScope optimizes for accuracy without sacrificing compliance. We implement a hybrid solution with cookieless, 24 hour anonymized attribution only for those regions where regulations require that, and more accurate longer-term attribution with cookies everywhere else and when explicit consent is provided.

Start a 14-day free trial and see the traffic your current analytics doesn't capture.

The terms are often used together, but they regulate different parts of analytics:

ePrivacy rules govern storing information on, or accessing information from, a visitor's device. This is broader than cookies: localStorage, sessionStorage, pixels, and some fingerprinting techniques can also be covered. Prior consent is generally required unless the operation is strictly necessary.
GDPR governs the processing of personal data. It requires transparency, data minimization, appropriate retention and security, and a lawful basis under Article 6. Consent is one lawful basis, but it is not the only one. An email or IP address is personal data under GDPR.

There is no technical workaround

An engineer's first reaction is often: "if cookies are the problem, I'll just use X instead". But that's wrong. The laws don't actually refer to cookies, they refer to any kind of storage on the user's device. They even cover identification via browser fingerprinting, IP address, or similar alternatives.

Storage alternatives

localStorage and sessionStorage still store information on the visitor's device and therefore ePrivacy applies. The law isn't about cookies, it's about device storage of any kind.

Even experts misunderstand this. DataFast cookieless analytics uses sessionStorage. Under ePrivacy, sessionStorage is still storage on the visitor's device. Despite their claim, DataFast is not compliant, and still legally requires consent before tracking anything.

Browser fingerprinting

Browser fingerprinting doesn't store anything, but builds a unique fingerprint from device characteristics.

Article 5(3) of Directive 2002/58/EC permits storing information or gaining access to information already stored on the user's device equipment only when:

the user has consented after receiving clear information; or
it is solely necessary to transmit a communication; or
it is strictly necessary to provide a service explicitly requested by the user.

It says "information," not "cookies" or even "personal data." Recital 24 expressly mentions "web bugs," "hidden identifiers," and mechanisms used build a fingerprint and trace users. Not writing an identifier back to the device therefore does not avoid Article 5(3).

WP29 Opinion 9/2014: fingerprints generated through device storage or access require consent unless an exception applies.
EDPB Guidelines 2/2023 especially paragraphs 1–4, 40 and 43: locally generated or derived information can be covered once it is accessed over the Internet.

Ordinary analytics is not "strictly necessary" to deliver the page requested by the visitor. WP29 Opinion 4/2012 expressly reached that conclusion.

IP-based identifiers

Some analytics use the IP address as a persistent identifier. Under GDPR, Article 4(1) and Recitals 26 and 30 treat online identifiers, including IP addresses, as personal data when they can single out a visitor. RevScope does not store IP addresses, for anybody. It's not necessary to provide high quality analytics.

CNIL, the French regulator, offers some of the clearest guidance. CNIL's 2025 Article 82 exemption for audience measurement allows cookieless identifiers if they are time limited (“composante temporelle”) for audience measurement for the publisher and not used for cross-site tracking / ad profiling.

First-party privacy-friendly analytics services like RevScope, Plausible, and Fathom have settled on 24-hour time-limited (configurable in RevScope) server-side hashes as the industry pattern for cookieless analytics. Without storing or accessing information on the user’s device, Article 5(3) of the ePrivacy Directive does not apply. The resulting short-lived hash is designed so it cannot support cross-day or cross-site tracking; any processing of identifiers used to compute it is usually assessed under legitimate interests rather than consent under GDPR.

How RevScope protects privacy and preserves attribution

RevScope changes attribution behavior based on the visitor's region and your explicit consent signal.

Situation	How RevScope behaves
No consent in an op-in region	No persistent identifier is placed on the device, and the tracker reads nothing from it: timezone, language, screen size, and touch support are left alone, so browser, OS, and device type are derived from the request headers the browser sends anyway. A pseudonymous session mapping is stored only in that project's database on the server, and expires after 24 hours. The visitors journey is not available for EU visitors unless they make a purchase or they give explicit consent.
Visitor opts out of all measurement	RevScope records the disabled preference locally, deletes any data for that user's session, and sends no further events.
Regions that don't require consent, or if user opts-in	RevScope uses a cookie-based identifier for greater accuracy and longer session attribution, and reads the timezone, language, screen size, and touch support of the device once per session.

Comparable 24-hour models are used by Plausible and Fathom. Both derive per-site hashes from request data and rotate their salt daily. RevScope captures a more complete view of your traffic by only being this strict about privacy and cookies in regions where required by law. It gives better accuracy in the rest of the world.

RevScope does not use the data for cross-site advertising profiles and does not sell visitor data. Its default privacy mode keeps measuring the traffic that consent-gated tools discard. If you optionally ask for consent, you can enhance the accuracy of your analytics in those regions while keeping cookieless measurement when consent is not given.

To wire a consent banner or opt-out link to the tracker, see Consent. For CCPA, LGPD, PIPEDA, APPI, and other global regulations, see Privacy laws.

See more of the journey from visit to revenue. Start a 14-day free trial and see what actually drives revenue.

References

This page provides general product and regulatory information, not legal advice.

GDPR and ePrivacy