Cookie-based tool
—Writes to the device, reuses the ID across sites and hands it to third parties. Needs a banner, and loses everyone who says no.
The question customers ask
Why can Sealmetrics measure without consent, and the others cannot?
Because the law does not forbid measuring. It forbids storing or reading things on the visitor's device without permission, unless the purpose is counting the audience of the site itself and nothing else. Most tools do not fit inside that exemption. Sealmetrics is built to fit.
EU-hosted in Dublin · DPA included · not legal advice · Germany: our reading, not settled
Quick answer
Consent for web measurement is required by the ePrivacy rules whenever a tool stores or reads information on the visitor's device, with two exemptions: what the site strictly needs to work and, under conditions, audience measurement for the site itself. A cookie-based tool such as GA4 writes a two-year identifier, reuses it across sites and feeds advertising, so it falls outside the exemption and needs a banner. Sealmetrics writes nothing to the device; it reads only what the browser sends anyway, computes a session identifier that rotates every day with a key that is destroyed at 04:00, does not store the IP address, and reports only aggregate counts for the site itself. That is the configuration the CNIL and the AEPD describe as consent-exempt audience measurement, as our own self-assessment reads it. The exemption has conditions and each country applies it its own way; in Germany it is not settled, and the banner stays for any other tool that needs it.
1 / 4 · In the browser
What a cookie tool does to the visitor's device
When the page loads, the GA4 script (or almost any analytics script) writes a cookie with an identifier that follows the visitor for two years, on that site and, through Google's network, on many others. Writing to the device is what the European ePrivacy rules (Art. 5(3)) make conditional on consent. That is why the banner appears.
Sealmetrics
—Writes nothing to the device. What it reads serves only to count this site's audience. It fits the audience-measurement exemption.
2 / 4 · The data that does reach us
What we do with it, step by step
If nothing is stored in the browser, how do we know two pageviews belong to the same visit? With an ephemeral identifier computed on the fly that expires. We do not keep it and neither does the visitor.
- A · The request arrives
What the browser already sends
Page, source (UTM), time, time zone, browser.
The IP is not stored: it is compared against a public list of automated traffic and discarded.
- B · Ephemeral ID
A calculation with a daily key
Those values plus a secret key of the day make the session identifier.
At 04:00 the key is destroyed. Not even we can rebuild the ID.
- C · Session
Two hours, then it ends
It joins the pages of one visit. Come back tomorrow and you are a new visit. There are no returning visitors.
- D · Report
Always a count
"142 visits from Google Ads to this landing page." Never "visitor A came back three times."
Retention, the same on every plan
- Technical log
- 1 day
- Hourly aggregates
- 90 days
- Daily aggregates and conversions
- 24 months
3 / 4 · The rule
The three questions that decide it
The European rule (ePrivacy, Art. 5(3)) says: storing or reading information on the visitor's equipment needs their consent, unless it is what the site strictly needs to work or, under conditions, audience measurement. Every tool goes through the same three questions. What changes is the answer.
Question 1
Does it touch the visitor's device?
Writing a cookie counts. Reading what the browser sends on its own (language, screen, time zone) also counts as access.
Cookie-based analytics (GA4)Yes, it writes
Leaves a cookie with an ID that lasts two years and reads it on every visit.
SealmetricsIt only reads, it writes nothing
It uses what the browser already sends. Reading is also access, so the rule applies and we move to question 2.
Question 2
Is it used only to count this site's audience?
This is the condition of the exemption: no profiles, no cross-site matching, no handing the data to third parties.
Cookie-based analytics (GA4)No
The same ID serves Google's advertising network and is matched across sites.
SealmetricsYes
Counts for this site and nothing else. No profiles, no advertising use.
Question 3
Does the identifier expire and stay unrecoverable?
The exemption requires that a person cannot be followed over time.
Cookie-based analytics (GA4)No
Same ID for two years. It recognises you every time you return.
SealmetricsYes
It rotates daily and the key it is computed with is destroyed. Tomorrow you are a new visit.
Result
Cookie-based analytics (GA4)Consent is required. Banner.
The Meta pixel and the "cookieless" analytics that keep a visitor ID in localStorage land here too.
SealmetricsFits the audience-measurement exemption.
No banner needed for measurement, in our self-assessment. How each country applies it is in the table below.
4 / 4 · The conditions
What a DPO checks, one by one
This is not a product label. It is how the system is built, and every row can be verified in the DPA and in the public documentation.
| Condition | Cookie-based analytics (GA4) | Sealmetrics |
|---|---|---|
| Writes no cookie and no localStorage on the device | No | Yes |
| No persistent visitor identifierOurs rotates every day and cannot be rebuilt | No · _ga, 2 years | Yes |
| Does not store the IP addressUsed on the fly to discard automated traffic, then discarded. Country is derived from the time zone. | No | Yes |
| Only the site's own audience, no cross-site matching | No · Google network | Yes |
| No behavioural profiles, no advertising use | No | Yes |
| Analytics data processed only in the EU | No · US by default | Yes · Dublin |
| Fixed, limited retention | Configurable · 2 or 14 months | Yes · 1 d / 90 d / 24 m |
| Reports are always aggregated | No · user explorer | Yes |
| First-party: the pixel is served from your own domain | No | Yes · 846 bytes |
What you get
What you have, and what you do not
Measuring without a persistent identifier has a price, and we would rather tell you ourselves. This is what the product does today, not a promise.
Yes, on the visitors the banner hides today
- Visits and pageviews by channel, campaign, source and landing page.
- Conversions and sales with their value, attributed last-click.
- ROAS and cost per conversion for every campaign carrying UTM parameters.
- A side-by-side with GA4 from day one.
- Traffic you do not see today: visitors who reject, visitors who never answer, and a good share of those running ad blockers.
No, because we recognise nobody
- Returning visitors. Whoever comes back tomorrow is a new visit.
- User-level data, cohorts, retention or funnels across days.
- Remarketing audiences. That still needs consent, with any tool.
- Cross-device. Your phone and your laptop are two visits.
- Multi-touch attribution across sessions on different days.
The installation mistake
The one mistake that throws it all away
Many teams put the Sealmetrics pixel inside the "analytics" category of their consent manager (CMP). It then loads only when the visitor accepts, and you lose exactly what you came to measure. The pixel does not need consent: it goes outside the CMP, in the base template, like the CSS.
Wrong: inside the CMP
<script type="text/plain"
data-cookieconsent="statistics"
src="https://your-domain.com/sm.js">
</script>
// loads only on accept: the rest is lost—You measure only those who accept. The same hole as GA4.
Right: outside the CMP
<script async
src="https://your-domain.com/sm.js">
</script>
// in the base template, before the CMP
// loads every time, writes nothing—You measure every visit. It is lawful because it does not touch the device for anything beyond audience measurement.
By country
How each authority applies the exemption
The rule is European, but each authority spells out the exemption. Look at the countries you sell in. Each row links to the authority's own publication or to our analysis of it.
| Country | Authority and document | Audience measurement without consent | Worth knowing |
|---|---|---|---|
| Spain | AEPD · Guía sobre el uso de las cookies and its guide on cookies for audience-measurement tools | Exemption with conditions | Inform in the privacy policy and keep the purpose to the site's own audience. Our analysis for Spain. |
| France | CNIL · Solutions pour les outils de mesure d'audience | Exemption with conditions | The reference document: limited purpose, no cross-site matching, bounded retention. Our analysis for France. |
| Italy | Garante · Linee guida cookie e altri strumenti di tracciamento (10 June 2021) | Exemption with conditions | The Garante treats analytics like technical cookies when it cannot single anyone out, the IP is masked, it measures one site only and produces aggregate statistics; a third-party provider may not combine the data with anything else. |
| Germany | DSK · Orientierungshilfe Telemedien (20 December 2021) · §25 TDDDG | Not settled | The DSK declines to declare audience measurement exempt and assesses it case by case; its only example without consent is a simple page counter that captures nothing else, and GDPR legitimate interest does not satisfy §25 on its own. Our reading is that Sealmetrics fits that example, but it is not settled: review with your adviser. Our analysis for Germany. |
| United Kingdom | ICO · Guidance on the use of storage and access technologies | PECR, own criteria | Outside the EU: the basis is PECR, not ePrivacy, and the ICO guidance has its own section on the statistical-purposes exception. The UK PECR analytics exemption, explained. |
For your legal team
Ready to paste to your DPO
You do not have to defend it yourself. Paste this to legal and ask us for the document package.
Summary for the DPO
We want to use Sealmetrics to measure the audience of our website. It writes no cookies and nothing else to the visitor's device. It processes the technical data the browser sends in order to compute an ephemeral session identifier that rotates every day with a key that is destroyed, so it cannot be rebuilt or matched across sites. It does not store the IP address. Reports are always aggregated. Analytics data is processed only in the EU (Dublin), with fixed retention: technical log 1 day, hourly aggregates 90 days, daily aggregates and conversions 24 months. It relies on the audience-measurement exemption to Art. 5(3) ePrivacy as applied by the AEPD and the CNIL, with legitimate interest (Art. 6(1)(f) GDPR) as the basis for the session identifier. The vendor provides a DPA, a TPSR review and documentation of EU hosting.
Paragraph for your privacy policy
Audience measurement. We use Sealmetrics to measure the audience of this website. It installs no cookies and stores nothing on your device. It processes the technical data your browser sends when a page loads in order to compute an ephemeral session identifier that rotates every day and cannot be rebuilt, and it does not store your IP address. The data is processed in the European Union in aggregate form, on the basis of our legitimate interest in knowing the audience of our website. To object to this measurement, see the rights section of this policy.
- What we give you: the DPA, the TPSR package (Transfer, Privacy and Security Review) and the documentation of the Dublin hosting.
- What stays yours: informing in the privacy policy. The exemption removes the banner for measurement, not the duty to inform.
30 days in parallel
You do not have to believe this page. Measure it.
Install it next to GA4, change nothing, and compare at day 30.
- Day 1
Install the pixel
5 to 30 minutes depending on the platform. Outside the CMP. First data within the hour.
- Days 1 to 30
Change nothing
GA4 keeps running. Sealmetrics measures beside it, on the same UTM parameters.
- Day 30
Compare visits and sales
By channel and campaign. The difference is your hidden traffic, and it is different on every site: that is why it has to be measured.
- Before you start
Estimate your loss
The data loss calculator gives you a first figure from your traffic and your acceptance rate.
Measured case · Incapto, Shopify store
GA4 missed 29% of visitsOver 48 days, Sealmetrics recorded 96% of real orders against the store's back office. Your figure will be different: measure it.
Read the caseFAQ
What customers actually ask
Can I remove the cookie banner?
Only if the only thing your site loads is Sealmetrics and what it strictly needs to work. If you keep GA4, the Meta pixel, remarketing or a third-party chat, the banner is still needed for them. What changes is that your measurement no longer depends on it.
Is this not fingerprinting?
What makes fingerprinting a problem is that it creates an identifier that persists and lets a person be followed over time and across sites. Our session identifier is computed with a key of the day that is destroyed at 04:00: the next day not even we can rebuild it, and it is never matched across sites. While it lasts it is pseudonymised data, which is why it has its own legal basis (legitimate interest).
Do I keep using GA4?
Yes, if you want to. They run side by side without conflict, and that is what we recommend for the first 30 days. Many customers keep GA4 for what they already had built and use Sealmetrics as the source of the real figure for visits and sales.
What about remarketing?
Sealmetrics does no remarketing and builds no audiences, because that requires recognising the person. If you need it, it still goes through consent with whichever tool you use. What we give you is the full measurement of what those campaigns bring.
What happens in Germany?
Germany applies the strictest reading of what counts as accessing the device (§25 TDDDG). We will not tell you "no banner needed" there without a caveat: our reading is that none is needed for Sealmetrics, but it is not settled. Review it with your adviser with our legal package in hand.
Why do other tools say "cookieless" and still need a banner?
Because "no cookies" is not the same as "no identifier". Many tools replace the cookie with a visitor ID in localStorage or a hash that never expires. For the rule that is the same as a cookie. What counts is whether you write anything, and whether what you read serves anything beyond counting this site's audience.
What personal data does Sealmetrics process?
We store nothing on the device and no data that identifies anyone. The session identifier is ephemeral: it rotates every day and, once it rotates, not even we can rebuild it. Reports are always aggregated. We do not store the IP: it is compared on the fly against a public list of automated traffic and discarded.
Next step
Run it next to GA4 for 30 days.
Book a 30-minute walkthrough with the founder. Bring your DPO: the DPA and the TPSR package are on the call.