If your analytics tool needs a cookie banner, you’re measuring a fraction of your visitors. When I was building Complianz, we tested a banner with a real “deny” button, and 98% of visitors clicked it. Put your statistics behind consent, and 98% of your data never gets measured.
Whether your WordPress site needs that banner for its statistics depends on where your visitors live. In the Netherlands, analytics cookies with little privacy impact are exempt from consent, but In Germany and Belgium there’s no such exemption.
The EU wants to end that patchwork. And the way it plans to do it says a lot about where analytics is heading: anonymous, self-hosted measurement gets a clear green light, and Google Analytics doesn’t.
One rule for the whole EU
In November 2025 the European Commission published the Digital Omnibus, a package that cleans up overlapping EU digital rules. One part moves the cookie rules out of the ePrivacy Directive and into the GDPR itself, as a new Article 88a.
That move matters more than it sounds. The ePrivacy Directive is a directive: every country writes its own version into national law, which is why the Dutch, German and Belgian rules differ today. The GDPR is a regulation. Its text applies directly, and it’s the same in every member state.
If you run sites for clients in several EU countries, that’s the real news. One rule instead of 27 interpretations.
Measuring your audience without consent
Article 88a lists four situations where you can store or read information on a visitor’s device without asking first. Three of them are the usual technical necessities, like transmitting a page or keeping a service secure. The fourth is new at EU level:
“creating aggregated information about the usage of an online service to measure the audience of such a service, where it is carried out by the controller of that online service solely for its own use”
In plain words, you can count your visitors without a banner if three things are true:
- Aggregated. You look at totals and trends, like pageviews, popular posts and traffic sources, not at profiles of individual people
- Your own service. You measure your own site, not visitors across the web
- Solely for your own use. The data stays with you. Nobody else gets to use it for their own purposes
Why Google Analytics doesn’t make the cut
That last condition is where Google Analytics runs into trouble. GA4 sends your visitor data to Google, and Google’s terms let it use analytics data to improve its own products and services. That’s not “solely for your own use”, however carefully you configure the property.
This will surprise some Dutch site owners. Today the Dutch data protection authority accepts a privacy-friendly GA setup without consent. Under one EU-wide rule, that national exception disappears along with all the others. If the proposal passes in this form, consent for Google Analytics becomes the rule everywhere in the EU, the Netherlands included.
Cookies stop being the enemy
Here’s the part I find most interesting. The exemption is about purpose, not technique. A first-party cookie that recognises returning visitors on your own site fits within it, as long as you use it for aggregated statistics and keep the data yourself.
For years, “cookieless” was the workaround that let you skip the banner in stricter countries. Under Article 88a it becomes a preference instead of a legal necessity. You can now choose between these two purely based on the technical background: cookieless measurement is less precise with returning visitors, while a cookie is visible to the visitor and easy to delete.
A fix for banner fatigue too
The proposal also tackles the banners that remain. If a visitor refuses consent, you can’t ask again for the same purpose for at least six months. And a new Article 88b requires websites to respect privacy preferences that people set once in their browser, instead of asking on every site.
What doesn’t change
Some caveats before you remove anything:
- It’s still a proposal. The Council is negotiating compromise texts and the Parliament hasn’t adopted its position yet. The details can change, and a realistic start date is 2027 or 2028
- Until then, national rules apply. The Dutch exemption stands, and Germany and Belgium stay strict
- The GDPR still applies. Even anonymous analytics briefly processes an IP address. You need a legal basis (for statistics that’s usually legitimate interest), a clear privacy statement and a way for visitors to opt out
What you can do now
If you want your sites ready for this, the steps are the same ones that already make sense today:
- Check what your site loads: open it in a private window and look at the Network tab in your browser’s developer tools
- Remove what you don’t use, starting with social media widgets and forgotten tracking pixels
- Move your statistics to a tool that measures anonymously and keeps the data on your own server
- Describe what you measure in your privacy statement, and what you don’t
That’s the setup Burst Statistics was built around. Your data stays in your own WordPress database, it’s anonymous by default and cookieless if you prefer. In most setups I’ve seen, that alone removes the reason the analytics banner was there in the first place. If you want to drop your cookiebanner, check out this article I wrote about that previously.
The EU is moving toward what privacy-friendly analytics already does. The sooner your sites work that way, the less you’ll need to change when the rules land.
