A Website With No Cookies or GDPR Banner: Legal, and Here’s How

The StartingUp Summer keeps taking the long view. After detailing the headless architecture powering this site, we look at what it doesn't have: it's a site with no cookies and no GDPR banner, no consent manager whatsoever. As with respecting your visitors' display preferences, this stripped-down approach is a deliberate choice, not an oversight.

You know the ritual. You click a link, the page loads, and before you've even read the first word, a panel blocks your path: "We and our 847 partners use cookies...". You look for the button that makes it disappear, you click without reading, you forget. Dozens of times a day.

The site you're reading right now hasn't asked you anything. No banner, no consent manager, no cookie dropped. And it's perfectly legal. Here's what the law actually requires, how we concretely go without it, and, with the same honesty, in which cases this choice will be closed to you.

A site with no cookie banner is perfectly GDPR-compliant, on one condition: dropping no tracker subject to consent. The law doesn't mandate a banner, it regulates trackers; a site that doesn't use any simply has nothing to get consent for.

The cookie banner was supposed to embody internet users taking back control of their data. It has become the opposite symbol: a reflex of avoidance. Usability studies converge: a few seconds of attention at best, a click to get rid of the obstacle, no memory of the choice made. Researchers gave this phenomenon a name: consent fatigue. Consent given out of exhaustion informs no one anymore; it protects nothing anymore.

On the publisher's side, the bill comes in two parts. In data first: since the "reject all" button has had to be just as accessible as "accept all" (the CNIL, France's data-protection authority, has required this since 2021), refusal has become massive and a significant share of traffic disappears from measurement tools. In conversion next: a panel covering the content on the first screen degrades the first impression and increases bounce rate. The banner cuts into the very data it was meant to legitimize, and damages the experience it interrupts.

First misconception: no text requires displaying a banner. The law regulates trackers, not banners. Two texts combine: GDPR, which governs the processing of personal data, and the ePrivacy directive (transposed in France into Article 82 of the Data Protection Act), which requires prior consent to read or write information on a user's device.

Now, this consent is only required for trackers not essential to the requested service. A session cookie that keeps a shopping cart or a login alive needs no permission at all. And a site that drops no tracker subject to consent mechanically has nothing to collect: the banner has no object there. That's our case.

The CNIL's doctrine goes even further: audience measurement can be exempted from consent, under strict conditions. Purpose limited to audience measurement alone, for the exclusive benefit of the publisher; anonymous statistics, with no cross-referencing with other processing and no tracking from one site to another; tracker lifespan capped at 13 months and data retention at 25 months. The CNIL publishes a configuration guide for Matomo, but issues no label and no whitelist: compliance remains the publisher's responsibility. Conversely, Google Analytics doesn't fit within this exemption, even in its "consent mode" or anonymized variants.

As we write this, Brussels is discussing easing these rules (the "Digital Omnibus" package). Nothing has been adopted: a site with no trackers is compliant today, and will remain so.

Going without a banner doesn't mean giving up on tools: it means replacing every tracking brick with an equivalent that isn't one. Four substitutions cover most of what showcase and editorial sites need.

Three families of solutions, in decreasing order of richness: a self-hosted Matomo configured in exempted mode (IP anonymization, no cross-site tracking, purpose limited to audience measurement); a natively cookie-free tool like Plausible, which stores nothing on the visitor's device; or, even more frugal, plain server-log analysis, which already suffices to count visits and spot content that performs. In all three cases, you lose individual profiles and behavioral targeting. You keep what actually helps steer an editorial site: knowing what's read, where readers come from, and what converts.

Loading a font via Google Fonts means sending every visitor's IP address to Google's servers: a German court penalized this as early as 2022, ruling that an IP address is personal data. The fix is trivial: host the font files on your own domain. With Next.js, next/font does it automatically at build time; on classic WordPress, a few woff2 files and an @font-face declaration are enough. Bonus: one less request, faster and more stable rendering.

A drawer anecdote: the first seed of this article was a 2022 draft, never published, that fit in three lines and recommended the youtube-nocookie.com domain. The intention was good, the solution incomplete: even in "privacy-enhanced mode," the YouTube iframe loads Google resources as soon as the page is displayed. The right practice is a clickable facade: the page shows a plain image (a thumbnail and a play button), and the player only loads when the visitor clicks. Nothing is sent to the third party before that deliberate action, and the page ends up markedly lighter.

Google's reCAPTCHA is a tracker like any other: it analyzes visitor behavior on behalf of a third party, which makes it subject to consent. Yet anti-spam works perfectly well without it: an invisible honeypot field, strict server-side validation, and rate-limiting on submissions stop the vast majority of bots. That's how our contact forms work, with no third-party script at all.

Let's be blunt: this model doesn't suit everyone. Three situations structurally require trackers subject to consent, and therefore a banner:

• Ad retargeting. Retargeting on Meta or Google a visitor who didn't convert requires tracking them from one site to another: that's the very definition of a third-party tracker.
• Fine-grained e-commerce attribution. Knowing which campaign, which keyword and which audience generated each sale relies on identifiers persisting across ad platforms and the storefront.
• Advanced behavioral personalization. Individualized A/B tests, recommendations based on history: no individual profile, no individual personalization.

Giving up the banner means giving up on this, and that trade-off carries a real strategic price: acquisition budgets steered with less precision, no remarketing, measurement that goes back to being statistical where it used to be individual. For a model built on targeted advertising, that price is prohibitive. For a showcase site, a brand media outlet or a services company whose clients come through search, recommendations and content, it's surprisingly low: most of what the banner was "buying" wasn't actually being used.

A site with no cookies and no banner isn't a legal feat, then: it's a series of ordinary technical decisions, made with a bit of consistency. The real question isn't "is it possible?" but "what does this say about you?"

Your first screen is your first impression. You can fill it with a panel listing your advertising partners, or with your content. A site that has nothing to get consent for sends a message no privacy policy will ever replace: here, we don't track you, we talk to you. It isn't a deprivation, it's a positioning: something your visitors notice in a second, and something your competitors, often, can't copy without rethinking their whole model. Restraint shows. In matters of trust, it may be the thing that shows best of all.