Analytics 2027: What the EU Cookie Reform Means Technically for Web Tracking

Planning web analytics for 2027 starts with permission to measure

A simple page counter and detailed advertising measurement serve different purposes. A counter might record views of a pricing page. Advertising measurement often connects ad clicks, visits and purchases. Planning these tasks separately helps limit the data collected. That does not automatically permit a “base layer” to run without consent.

Status: 25 October 2026. The proposed EU reform is not yet law. A launch in 2027 requires a check of the rules then in force and the actual processing involved. A fixed EU-wide permission for consent-free web analytics from 2027 has not been established.

Existing rules and proposed changes

In Germany, section 25 TDDDG generally requires consent to store information on a device or access information already stored there. Exceptions cover the sole purpose of transmitting a communication over a public telecommunications network and operations strictly necessary for an explicitly requested digital service. These exceptions do not give general audience measurement a blanket exemption. Further background is available in the article on Article 5(3) of the ePrivacy Directive.

Processing personal data also needs a lawful basis under the GDPR. “No cookies” and “no names” do not automatically mean anonymous or consent-free. Rules on device access can also cover pixels and URL-based tracking.

On 21 October 2026, the Council adopted a negotiating position on the Digital Omnibus. This is a proposal for further negotiations. An agreement with the European Parliament and the final legislation are still pending.

The relevant records are the Council announcement, Council mandate ST 14756/26, especially pages 156–158, and the Parliament procedure record. Earlier reports about a pending Council vote describe an older stage.

What the French example shows

The French data protection authority CNIL describes a narrowly defined audience-measurement exemption. Purpose, data collected and configuration matter. A product name is not evidence of eligibility, and French conditions cannot simply be transferred unchanged to Germany.

For the exemption described there, measurement must remain limited to statistics for the relevant publisher. Combining visitor data across websites or reusing the data for other purposes does not fit that scope. CNIL recommends suitable lifetimes, for example 13 months without automatic extension, and a maximum of 25 months for collected information. These figures are not a general EU law.

A practical assessment starts with a list of every field: page category, time, source, identifiers and recipients. A shortened IP address may still allow a connection to an individual. Small tables containing rare events may also allow such inferences. Adding values together does not by itself anonymise the data.

Recognising GPC and understanding its scope

Global Privacy Control, or GPC, communicates a privacy preference. It can appear as the HTTP header Sec-GPC: 1 and as navigator.globalPrivacyControl === true. The W3C draft primarily addresses sale, sharing and cross-context advertising use of personal information. GPC is not a universal statement about every form of web analytics. Absence of the signal is not consent either.

California’s AB 566 requires a configurable browser feature from 1 January 2027 within its scope. This establishes neither a worldwide default nor general European permission to measure. A website must account for the signal, applicable requirements and choices recorded through the consent banner together.

Detecting the value must actually stop the affected data flows. A JavaScript variable alone does not stop an advertising tag that has already loaded. The server must also enforce the permitted recipients. Diagnostic records should remain minimal: full request URLs can contain search terms, email addresses or other confidential values.

Two separate measurement tasks, without an automatically enabled base

Simple statistics: predefined events and broad categories only, with a separately checked permission to process. Detailed measurement: additional data only for the permitted purposes. If consent is required and absent, the operation remains blocked. An “unknown” choice must not silently become “allowed”.

The configuration must distinguish purpose, recipient and valid choice. Withdrawal must prevent further consent-dependent events. Existing data and any necessary deletion need a separate process. A single consent_state field does not implement these rules.

GA4, Matomo and custom endpoints

GA4: Consent Mode adjusts tag behaviour using the supplied consent states. In advanced mode, cookieless pings can still reach Google when storage is denied. This remains a transmission. An architecture without such requests before consent must block the relevant tags until permission is granted. A technical setting does not establish a lawful basis.

Matomo: requireConsent and requireCookieConsent have different effects. The former blocks tracking requests until consent; the latter initially blocks cookies only. Calling disableCookies therefore does not automatically make an installation consent-exempt. URL contents, visitor identifiers, add-ons, retention and server logs also matter.

Cookie lifetime also needs a precise check. The inspected Matomo source calculates visitor-cookie expiry from the original creation timestamp. A blanket claim that each visit extends this cookie is incorrect for that implementation. setReferralCookieTimeout(0) does not disable the referral cookie: in the inspected code it produces a cookie without a fixed expiry date. An additional helper cookie is therefore not a generally required solution.

Custom server: An owned endpoint can restrict fields and onward transmission. The incoming connection still exposes information such as an IP address. Proxy, web-server and error logs must therefore be included in the assessment. A CNAME subdomain or an intermediary server does not remove consent requirements or browser protections.

A small example requiring explicit permission

The following partial example transmits only three predefined page labels. The function is called for the intended page view; without allowed: true, nothing is sent. That value must come from the assessed consent or exemption rule. The code itself does not check a lawful basis. It does not copy free text, full URLs or campaign parameters.

async function recordPageView({ allowed = false, page = "", fetchImpl = fetch } = {}) {
  const pages = new Set(["home", "pricing", "contact"]);
  if (allowed !== true || !pages.has(page)) return "skipped";
  try {
    const response = await fetchImpl("/metrics", {
      method: "POST",
      credentials: "omit",
      referrerPolicy: "no-referrer",
      redirect: "error",
      keepalive: true,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ event: "page_view", page })
    });
    return response.ok ? "accepted_http" : "http_error";
  } catch {
    return "network_error";
  }
}

accepted_http means only that the endpoint returned a successful HTTP response. Correct storage needs separate server confirmation or monitoring. Repeated calls can count twice. The endpoint must validate inputs, limit sizes and define permitted events: browser checks can be bypassed. The example does not include a complete server.

Daily totals without repeated inserts

For an existing ClickHouse table named analytics_events, with day Date, page String and event String, this query reads one specified day. Each row represents a received event. The report_day parameter is a date; collection must assign the day using an agreed time zone.

SELECT
    day,
    page,
    count() AS received_page_views
FROM analytics_events
WHERE day = {report_day:Date}
  AND event = 'page_view'
GROUP BY day, page
ORDER BY day, page;

The query counts received page views, not people or sessions. Running it again inserts nothing. Duplicate or late source events can nevertheless change the result. Retention requires a separately checked process; this query deletes nothing. The result is not automatically anonymous either.

What the numbers can establish

Detailed measured visits divided by a simple page-view count do not produce an exact consent rate. The numerator and denominator describe different events. A banner rate might instead count valid acceptances and valid decisions in the same period, with repeated decisions handled consistently. Undecided cases must not disappear unnoticed.

Extrapolation remains an estimate. Suppose 50 purchases are measured across 500 comparable visits. Applying that rate to 1,000 visits gives an estimate of 100 purchases. This assumes a similar purchase probability in the unmeasured group. The consent decision itself may be associated with different behaviour. Splitting the data by channel or device does not automatically eliminate that bias.

Rates fluctuate sharply in very small samples. With zero measured visits, division is undefined. The report then needs a missing estimate, not an invented zero. Measured values, estimates and missing data should remain visibly distinct.

Browsers can restrict storage, block requests or delete data earlier. Network errors, duplicate calls, bots and different time zones also change the numbers. A page view without further interaction does not prove a bot. Server logs are not a complete reference count of human visits either. Comparisons require matching event definitions, periods and filters.

Checks before launch

• Record permission, fields, recipients and retention for each measurement purpose.
• Test unknown choice, acceptance, refusal and withdrawal against actual network requests.
• Enforce GPC and other applicable requirements through every affected recipient.
• Check URLs, logs and rare combinations for personal information.
• Use matching event definitions and time zones for comparisons; make failures and duplicates visible.
• Check the law in force again before the planned launch.

Questions and answers

Does the EU automatically permit consent-free web analytics from 2027?

No general starting date has been agreed. The Council mandate is a negotiating proposal. Existing requirements apply until an actual change takes effect.

Is a cookieless measurement tool automatically anonymous?

No. Requests can contain IP addresses, page contents or other identifiers. The full processing operation, including server logs, matters.

Does Matomo extend its visitor cookie on every visit?

In the inspected source, the original creation timestamp remains the basis for expiry. The deployed version and any modifications need checking.

Can counting continue with GPC enabled?

That depends on purpose, data collected and applicable rules. GPC is neither general permission nor a universal rejection of all statistics. Any required consent must be present independently.

Can extrapolation replace missing measurement?

An estimate can help inform decisions but still depends on assumptions. Small or unsuitable comparison groups do not support reliable extrapolation.

Sources

• § 25 TDDDG
• Council: Digital Omnibus mandate, 21 October 2026
• Council: ST 14756/26, pages 156–158
• CNIL: audience measurement exemptions
• W3C: Global Privacy Control
• CalPrivacy: browser opt-out signals from 2027
• Matomo: tracking and cookie consent
• Matomo: inspected tracker source
• Google: consent mode overview
• ClickHouse: query parameters