Does cookieless tracking require consent?

Cookieless tracking can require consent. The fact that a tracking method does not use cookies does not automatically mean that consent is unnecessary.

The key question is how the technology works and what information it accesses or processes. For example, a tracking method may use browser fingerprinting, device identifiers or other techniques to recognise a visitor or access information stored on their device.

In the EU, ePrivacy rules can apply to technologies that access or store information on a user’s device, including methods that do not involve conventional cookies. Whether an exemption applies depends on the technology, purpose and applicable national rules. The EDPB’s technical guidance explains the scope of these rules.

Separate data protection requirements may also apply when the information processed qualifies as personal data. This can include requirements relating to a lawful basis, transparency and user rights.

Therefore, terms such as “cookieless” or “anonymous” do not by themselves establish that tracking is exempt from consent requirements. The actual technology, purpose and data flow need to be assessed.