Cookieless tracking can be part of an appropriate analytics implementation, but the absence of cookies does not decide whether consent is needed or whether the processing satisfies GDPR. Review device access, personal data, purpose, configuration and the rules that apply to the deployment.
Keep two questions separate
First, determine what the implementation stores on or accesses from a device. The UK's ICO guidance on storage and access technologies includes web storage, pixels, scripts and fingerprinting techniques. Review the relevant conditions and exceptions rather than assuming that localStorage or server-side collection is outside the rules.
Second, determine whether the information processed is personal data and what requirements follow. The EDPB explains the difference between pseudonymisation and anonymisation: replacing a name with a hash or opaque identifier does not automatically make the result anonymous.
Inspect the actual data flow
Use a fresh synthetic browser session to inspect cookies, localStorage, sessionStorage and network requests. Record identifiers and their lifetimes, URL parameters, custom event properties, diagnostic payloads and every receiving service. Review identification, replay and other optional features separately.
Databuddy avoids analytics cookies but uses browser storage and sends analytics requests to a collector. Identification and custom properties can change the context processed. It is incorrect to describe this as a guarantee that no personal data leaves the device. Begin with the Databuddy collection reference.
Review consent and exemptions for the configuration
Ask the responsible reviewer to determine the collection rule for the intended technology, purpose, audience and jurisdiction. An exemption, where available, has conditions; a provider's product name or general marketing statement does not establish that those conditions hold on your site.
Include advertising, embedded media, chat, experiments and diagnostic services in the inventory. Replacing a website analytics script does not remove requirements for other services. If collection requires consent, verify that the implementation follows acceptance, refusal and withdrawal. Do not bypass a refusal to improve a report's totals.
Hosting and contracts remain separate decisions
Document processing locations, subprocessors, retention, access and the relevant agreements. Self-hosting makes your team responsible for deployment and operations, but infrastructure, backup or support suppliers may still be involved. A regional server location alone is not a complete transfer or compliance assessment.
Keep evidence of the reviewed implementation
- Record the tested tracker version and enabled configuration.
- Save synthetic payload and storage observations without production personal data.
- Verify the applicable collection controls and supported data lifecycle procedures.
- Assign an owner and repeat the review after changing identification, features or destinations.
The seven-check technical worksheet provides the implementation audit. The consent-interface guide helps connect the review to website behavior. Neither a script label nor this guide is a legal determination about an entire installation.