Short answer: if Zenovay's cookieless mode is the only tracking on your site, you do not need a consent banner for the tracker itself. You may still need one for marketing pixels, embedded media, or other third-party scripts.
Why no banner is required for cookieless Zenovay
ePrivacy Article 5(3) (and its national versions — TDDDG §25 in Germany, FMG Art. 45c in Switzerland, PECR in the UK) only requires consent when you store information on, or read information from, a visitor's device.
In cookieless mode Zenovay:
- Does not set any cookies
- Does not write to
localStorage,sessionStorage, orIndexedDB - Uses an in-memory window-scoped ID that vanishes when the tab closes
There is nothing stored on the device, so there is nothing for the visitor to consent to under Art. 5(3).
Server-side, GDPR still applies — but legitimate-interest processing of pseudonymous analytics is generally compatible with Article 6(1)(f) when you disclose it in your privacy policy.
When you still need a banner
You need consent (and therefore a banner or equivalent) if your site loads any of these:
- Marketing pixels — Meta Pixel, Reddit Pixel, Google Ads conversion pixels, LinkedIn Insight Tag
- Google Analytics — both GA4 and Universal Analytics use cookies
- Hotjar / FullStory / Microsoft Clarity — session-replay tools that store device state
- Embedded YouTube / Vimeo / Spotify — these set their own cookies on load
- Live-chat widgets — Intercom, Drift, Zendesk all use cookies
- A/B testing tools — Optimizely, VWO, Google Optimize use cookies
If any of those load before consent, you need a banner.
What about Zenovay if I switch off cookieless mode?
If you set data-cookieless="false" to use a 30-day visitor cookie instead, the tracker becomes a "non-essential cookie" under ePrivacy. You then need consent before it loads — same as Google Analytics or any other tracking cookie.
What about GPC?
Whether or not you show a banner, Zenovay still honors Sec-GPC: 1 server-side. A visitor with GPC enabled is excluded from analytics regardless of what the banner says. See Global Privacy Control.