Cookieless analytics: measuring traffic at peace with Law 25

The site you're reading right now shows no consent banner. That isn't an oversight. It measures its traffic with Fathom Analytics, a tool that sets no cookie and stores no personal information, so there is nothing to ask consent for. We made that choice a while ago, and it comes with a real trade-off we spell out below. It follows directly from what we describe in our guide to Law 25 applied to your website.

The usual conversation stalls fast. On one side, "you need a banner". On the other, "we'll lose our data". Nobody asks the question that matters: what does the banner buy you, exactly, and at what price. This article does the math in both directions, and for most SMB sites it tips the way you wouldn't expect.

The short answer, for the busy

A cookieless analytics tool measures your traffic without placing a file on the visitor's device and without storing personal information: page views, traffic sources, country, device, conversion events. Fathom, Plausible and self-hosted Matomo all work this way. Under Law 25, that distinction decides everything. The law governs personal information, defined in section 2 as any information that concerns a natural person and allows that person to be identified, directly or indirectly. A tool that collects none of it triggers neither the prior notice required by section 8.1 for technology with identification, location or profiling functions, nor the privacy impact assessment of section 3.3, nor a banner. What you give up: one visitor's path from one visit to the next, and advertising retargeting audiences, which need a persistent identifier. What you get back: all of your visits measured, instead of the share that accepts the banner.

What Law 25 actually targets in a measurement tool

Three sections do the work, and none of them mentions a banner.

Section 2 sets the definition that governs the rest: personal information is "any information which relates to a natural person and directly or indirectly allows that person to be identified". An aggregate page-view counter with no persistent identifier doesn't qualify. The law has nothing to govern because there's nothing to protect.

Section 8.1 kicks in when you collect personal information using technology that includes functions allowing the person to be identified, located or profiled. You must then inform the person beforehand that you're using such technology, and of the means available to activate those functions. Our reading, a cautious one, is that a standard Google Analytics 4 setup lands there: Google's own documentation describes the _ga cookie, two-year default lifetime, as "used to distinguish users". Distinguishing a user from one visit to the next is exactly an identification function.

Section 3.3 is the one SMBs forget. It requires a privacy impact assessment for any project to acquire, develop or overhaul an information system that involves collecting, using, releasing, keeping or destroying personal information. Installing an analytics tool is an information-system acquisition. If the tool collects personal information, you document the assessment. If it collects none, the condition isn't met and there is no assessment to produce.

One counterintuitive detail to close, because it gets cited backwards. Section 9.1 requires that the privacy settings of a technological product offered to the public provide the highest level of confidentiality by default. Its second paragraph then carves out an exception in plain language: "The first paragraph does not apply to privacy settings for browser cookies." So section 9.1 is not your basis for blocking cookies by default. Section 8 and the consent regime of section 14 are what do that job.

What a cookieless tool measures perfectly well

The underlying fear is that you're trading compliance for blindness. In practice, what stays measurable covers roughly everything an SMB looks at. Plausible publishes its full collection list: page URL, HTTP referrer, browser, operating system, device type, and country, region and city derived from the IP address, which is never stored. Fathom includes event tracking, ecommerce and UTM campaigns on every plan at no extra cost. So you know which pages get read, where visitors come from, which campaigns bring people in and how many forms get submitted. That's everything you need to decide what to write, what to fix and where to put your acquisition budget.

What you give up, and what you had already lost

Here's the part vendor sales pages skate over. Without a cookie, there is no stable identity over time. Plausible says so in its data policy: all data is isolated to a single day, a single website and a single device. Its unique-visitor count comes from a hash combining a daily salt, the domain, the IP address and the user agent, and that salt is rotated and deleted every 24 hours. The direct consequence: nobody can tell you that the person who read three articles in July is the one who filled out the form in August.

Second loss, more serious if it applies to you: retargeting audiences. Retargeting someone requires a persistent advertising identifier. A tool that creates none cannot feed Google Ads or Meta. If retargeting is a meaningful channel for you, that settles it, and you should own the decision.

But measure what you had already lost first. Google's documentation says it plainly: browsers cap the lifespan of first-party cookies when a visitor doesn't return, at a maximum of 400 days in Chrome and 7 days in Safari. Your "returning visitors over six months" number is therefore already fiction for your entire iPhone audience. And a standard GA4 property caps user-level data retention at 2 or 14 months. Fathom keeps your full history for as long as you're a customer, so comparing one August against the last is easier without cookies than with them.

The calculation almost nobody runs

Which leaves the real question: what does the banner cost. The 2025 Cookie Consent Benchmark Study by the German vendor etracker measures the effect across a sample of sites. The finding: with a dialog designed the way supervisory authorities require (a reject button as accessible as the accept button), an average of 60% of visit data is lost, and sites with a compliant design record 14 percentage points less consent than sites that visually nudge toward acceptance. Those numbers come from a European analytics vendor, so an interested party, on a German sample. Read them as an order of magnitude, not as a Quebec figure.

Bias costs you more than the missing volume does. Consent rates vary sharply by channel and campaign, so the data that survives is not a random sample of your visitors. Your conversion rates end up comparing channels that had different acceptance rates. Partial but unbiased beats partial and skewed.

Google's answer to this is behavioural modelling, which statistically reconstructs the visitors who declined. Except the eligibility thresholds Google publishes are out of an SMB's reach: the property must send at least 1,000 events per day with analytics_storage='denied' for at least 7 days, and have at least 1,000 daily users with consent granted for 7 of the previous 28 days. A site with 3,000 visits a month will never get there. Modelling is an answer for large sites, not for you.

Four options, by need

Fathom Analytics. US$15 per month for up to 100,000 page views, 50 sites included, 7-day trial. Canadian company (Conva Ventures), and EU traffic isolation is included on every plan. It's our default.

Plausible. $9 per month up to 10,000 page views, $19 at 100,000. Open source and auditable, EU-hosted. The right pick if entry price matters or you want to inspect the tool yourself.

Self-hosted Matomo. The On-Premise version is free and, per Matomo, always will be. You run it on your own server, so data never leaves your infrastructure. Free doesn't mean costless: you need a server, updates and someone to mind it. Matomo Cloud starts at CAD 29 per month before tax for 50,000 hits.

GA4 with consent mode. The rational choice if advertising retargeting is central to your acquisition. You keep the Google ecosystem and you pay in banner, missing data and bias.

What we do, and why

We install cookieless analytics by default for our clients and on our own sites. The reasoning fits in one sentence: the decisions we make from the numbers (which pages generate inquiries, which sources work, which forms stall) don't depend on knowing a visitor's identity from one visit to the next.

If your decisions genuinely do depend on it, keep GA4 and build the banner properly, backed by a privacy policy that supports it. What doesn't hold up is the third path, the most common one: keep GA4, drop in a decorative banner that blocks nothing, and believe the numbers are complete. That way you collect the compliance risk and the skewed data at the same time.

Picking your measurement tool belongs to the same conversation as the rest of your Law 25 obligations, and it's one of the first calls we make when we build or rebuild a site.

→ Let's talk about your site and your measurement, no commitment

This article explains how Law 25 applies to web measurement tools to help an SMB ask the right questions; it is not legal advice. How a specific tool qualifies depends on its actual configuration and the data it processes. The Commission d'accès à l'information has published no decision naming any analytics tool: the readings offered here are ours. Validate your situation with legal counsel before removing an existing banner.