Short answer: in cookieless mode Zenovay stores nothing on the visitor's device, which is the thing most consent rules are written around. Marketing pixels, embedded media, and other third-party scripts on the same page are a separate question, and they are usually the reason a site needs a banner.
What cookieless mode changes for consent
ePrivacy Article 5(3), and its national versions (TDDDG §25 in Germany, FMG Art. 45c in Switzerland, PECR in the UK), turns on whether you store information on, or read information from, a visitor's device.
In cookieless mode Zenovay:
- Does not set any cookies
- Does not write to
localStorageorIndexedDB - Uses an in-memory window-scoped ID that vanishes when the tab closes
There is one exception. If you use Zenovay's exit-intent widgets, a __zv_widget_shown_session marker is written to sessionStorage so the same visitor is not shown the same popup twice. It is written regardless of cookieless mode and cleared when the tab closes. Leave the widgets off if you want a site that writes nothing at all.
Server-side, GDPR still applies. The hashed visitor identifier is pseudonymous personal data, so it needs a lawful basis and a description in your privacy policy. Which basis fits, and whether a banner is required on top of that, depends on your jurisdiction and on how you use the data. Confirm it with your own privacy advisor rather than reading it off this page.
When you still need a banner
You need consent (and therefore a banner or equivalent) if your site loads any of these:
- Marketing pixels: Meta Pixel, Reddit Pixel, Google Ads conversion pixels, LinkedIn Insight Tag
- Google Analytics: both GA4 and Universal Analytics use cookies
- Hotjar / FullStory / Microsoft Clarity: session-replay tools that store device state
- Embedded YouTube / Vimeo / Spotify: these set their own cookies on load
- Live-chat widgets: Intercom, Drift, Zendesk all use cookies
- A/B testing tools: Optimizely, VWO, Google Optimize use cookies
If any of those load before consent, you need a banner.
What about Zenovay if I switch off cookieless mode?
If you switch to the first-party cookie mode, the tracker stores a visitor cookie on the device (30 days by default). That puts it in the same category as Google Analytics or any other tracking cookie for consent purposes.
What about GPC?
Whether or not you show a banner, Zenovay honors Global Privacy Control, and that cannot be switched off. When a visitor's browser signals GPC, the tracking script stops before it sends anything, so there is no visit to consent to either way. Requests that reach the ingestion API without running the script, such as server-side events, are checked for the Sec-GPC header and have their behavioural enrichment suppressed. See Global Privacy Control.