Knowledge base article
Do You Need Consent for Analytics? Rules in the Netherlands, France, Germany and Belgium
Whether you need a cookie banner for your analytics depends on two things: what the tool stores on your visitors’ devices, and in which country your audience is. The Netherlands and France allow some analytics without consent, Germany and Belgium do not. This article sets out the rules per country, with the official sources, so you can check them yourself.
These are the rules as of 31 October 2026. Laws and regulators’ guidance change, so check the linked sources for the current version.
We are not lawyers. New Metrics is made by analytics specialists, and this article is not legal advice. Before you decide whether your site needs consent, always get professional legal advice for your own situation.
What EU law says
The ePrivacy Directive (2002/58/EC, article 5(3)) requires consent before a website stores information on a visitor’s device or reads information from it. The only exceptions are storage needed to send a communication, or storage strictly necessary for a service the visitor explicitly asked for. The directive has no exception for analytics.
The rule is not limited to cookies. In Guidelines 2/2023 (version 2.0, adopted 7 October 2024), the European Data Protection Board says it also covers tracking pixels and links, local storage, unique identifiers and device fingerprinting. Each EU country writes the directive into its own law, which is why the rules for analytics differ per country.
Netherlands: no consent for analytics with little privacy impact
Article 11.7a of the Telecommunicatiewet exempts cookies used to measure the quality or effectiveness of a website, provided they have no or little effect on visitors’ privacy. The Autoriteit Persoonsgegevens calls these “beperkt analytische cookies”: they collect information such as the number of visitors and the most visited pages. On its cookie page the AP says a website owner does not need consent for them. If these cookies process personal data, the owner still needs a legal basis under the GDPR and must mention them in the privacy statement.
Cookies that follow visitors across websites or build profiles (tracking cookies) always need consent.
France: an exemption under strict conditions, no approved list
Article 82 of the French data protection law (loi Informatique et Libertés) allows audience measurement without consent if it meets the conditions of the CNIL, France’s regulator. According to the CNIL’s conditions (July 2025), the tool must:
- measure only the audience of your own site or app, on your behalf;
- produce anonymous statistics only, with no session replay and no following of a single visitor;
- not track visitors across sites or apps, and shorten IP addresses;
- collect at most three kinds of events, without campaign or UTM parameters, CRM identifiers or marketing channel measurement;
- be run by a provider that processes the data only for you and does not reuse it for its own purposes;
- offer visitors a way to opt out.
The CNIL used to publish a list of approved tools. In July 2025 it replaced that list with a self-assessment tool for providers. There is no current list of exempt products, so you or your provider must check the configuration against these conditions yourself.
Germany: consent required
Section 25 of the TDDDG requires consent for storing or reading information on a device, unless it is strictly necessary for a service the visitor explicitly requested. Germany has no exemption for analytics. The German regulators’ guidance (Orientierungshilfe Digitale Dienste, version 1.2, November 2024) deliberately does not say that audience measurement can run without consent; it can only be judged for a precisely defined setup.
Belgium: consent required
The Belgian regulator (APD/GBA) says there is no exemption for analytics cookies under current Belgian law, also not for first-party cookies, because counting visitors is not strictly necessary for the service the visitor asked for.
What the tools store on the device
We test each tool’s default install code on our own test page and record what it stores before anyone gives consent (see “Measured by New Metrics” on each tool page). On 31 October 2026:
Stores cookies or browser storage on the first page view:
Stores nothing on the device:
- Cloudflare Analytics
- Fathom Analytics
- Pirsch Analytics
- Plausible Analytics
- Simple Analytics
- Swetrix
- Umami
A tool that stores nothing does not automatically fall outside the rules: according to the EDPB, reading information from the device or tracking pixels can also count. In Germany and Belgium, assume you need consent unless your lawyer says otherwise. In the Netherlands and France, a privacy-friendly tool set up for anonymous statistics only can run without a banner, under the conditions above. Many tools also have settings that change what they store, so check your own setup.
