Do cookie-free analytics need cookie banners?

> While [cookie-based analytics] are often considered as a ‘strictly necessary’ tool for website operators, they are not strictly necessary to provide a functionality explicitly requested by the user […]. As a consequence, these cookies do not fall under the [exemption].

Companies can still do it illegally of course, and many do, but there is no law that can stop people from doing illegal things.

Here's an example you might be familiar with from a business setting: sometimes you can't disclose the identity of certain customers but you really want to talk about them as a reference when selling your product. So instead of "Microsoft" you might say "a big company from Redmond". You're not identifying which company you are talking about but you're providing enough context clues to narrow it down to the point where the most likely company you might be referring to is Microsoft. If you then go on to say something about "the big company from Redmond", that information will clearly be tied to Microsoft (or a very small group of companies where Microsoft is the most likely one) and you might be violating the non-disclosure agreement without ever having explicitly named the customer.

Back in the day, a user agent string would only tell you the OS and browser, with version numbers often only narrowing it down to maybe a year or so. But with browser and OS releases becoming so frequent, the exact version numbers alone will already often vary even between users using "the same" browser and OS and additionally it may sometimes contain information about plugins and other installed software. Alone this is unlikely to narrow it down enough to qualify as "personally identifiable" but that depends entirely on what else you store alongside it (and things like timestamps are definitely additional important context clues).

The problem with ads is that they don't want to only do fraud prevention, they also want to do deep behavioral analytics and targeting. You can't do that with data you collected for the purpose of fraud prevention because it's a different purpose altogether.

> The sad thing with analytics is that the dreadful banner makes it look like my site that only sets a cookie to know what is an unique visitor looks the same than other site that collects hundreds of data variables and then sell the data to hundreds of third parts, making the data sharing a business in itself.

If your cookie only exists to identify visitors across requests for purposes that meet the definition of legitimate interest or any other legal basis for a mechanism than consent, you do not need a "banner" (really: consent form). You don't even need a notice, just a privacy policy explaining it. An example for this are session cookies for logins - cookies for things like dark mode are slightly different but you don't have to frontload the consent request for that.

We don't shove a consent form in people's faces when we first talk to them just because of all the things we might need their consent for later in the day. I'm not sure why so many of us think we need to do this for websites that don't immediately require that consent to do something with it. Especially when consent can be withdrawn (or given) at any time.

By the way: this also aligns with the implementations of the ePrivacy directive done by individual countries.

Just go and read individual laws of each country, but the myth that "even login and shopping cart cookies need consent" is just a myth. It would be impossible to comply to both ePrivacy and GDPR if this was the case.

As much as the cookie banner industry is trying to tell you, you don't need TrustArc, OneTrust or other shady products on every website. Just don't do shady shit. First because you don't need it, second because, as you said, these products are almost always doing some illegal shit.

> You can collect anything without limits as long as you don’t associate this data with identification data / profiles.

That's completely wrong, the whole article is about the issue of reading data from the visitors device and needing a cookie banner for that. So you can't "collect anything without limits" in fact you can't collect any data from the visitor device. Which leaves a very narrow option of counting without using things from the device.