Every site that measures visitors faces the same choice: accept the cookie banner — that element nobody reads and everybody clicks to make it go away — or give up knowing who visits the site. This blog has no consent banner and still measures visits, pages, and real Core Web Vitals. The difference is not a gray area of compliance: it depends on the measurement tool chosen and on there being no other third-party code with an identifier on the site.

It is not “using analytics” that requires consent. It is tracking the individual — storing an identifier in their browser (a cookie, a device ID, a fingerprint combining browser characteristics) that makes it possible to recognize them across visits or across sites. It is that persistent trail, tied to the person, that the LGPD (Lei Geral de Proteção de Dados) — and its direct European reference, the GDPR (General Data Protection Regulation) — treats as personal data and requires a legal basis for: in practice, the banner asking for permission.

Google Analytics works this way by default: its own cookie per visitor, _ga, which persists for up to 2 years. That is why practically every site with GA has — must have — a consent banner (CMP) in front.

What Cloudflare Web Analytics measures without that

The Cloudflare Web Analytics this blog uses writes nothing in your browser. No cookie, no localStorage, no screen/font/plugin fingerprint. Each page load is a loose event — visit, path, load time, Core Web Vitals metrics — with no thread connecting that event to your next visit. Without a persistent identifier, there is no “tracking” in the sense the law regulates; that is why there is no requirement for prior consent.

It is not a gray area: without a persistent identifier, there is nothing to consent to.

Technically, this is possible because Cloudflare is already on the path of every request to the site (it is the CDN/proxy) — the measurement beacon runs on the same edge that already processes each visit, without needing to “follow” the visitor between visits in order to count correctly.

What you can know (and what this blog actually looks at)

From the Fluxonar dashboard today: visits and page views by page, country of origin, device type, and above all real field Core Web Vitals — LCP, CLS, load time — captured from real people, not only from the Lighthouse lab. That is, in fact, how we confirmed that the site loads quickly and stably for people who actually visit, not only in a local test.

What this can answer: which posts get more reading, whether the site is fast for the people who access it, and where the audience comes from. Product and performance questions — what actually guides the decisions on this blog.

What you give up

Here is the honest trade-off, with no sales pitch: without a persistent identifier, you cannot build an individual journey. You cannot know that the same person visited post A on Monday and came back to post B on Thursday. You cannot build a person-to-person conversion funnel, or an audience for remarketing, or campaign attribution across sessions separated in time. That is the core of what Google Analytics offers in addition — and it is exactly what requires the cookie and, with it, the banner.

For a content blog, whose job is to publish good posts and see whether people read them, that trade is worth it: real performance and reading volume, yes; an individual behavioral profile, no. For an e-commerce business optimizing a purchase funnel person by person, the math probably comes out differently — and then the cookie (and the banner) make sense.

The second condition: no other third-party code

Update note (October 29, 2026): this section incorporates the lesson of the post “The policy corrects itself; the published text does not,” published on September 4, 2026, which no longer exists as its own page.

The first version of this text said that the absence of the banner depended only on the measurement tool. That was a half-truth. Measuring without an identifier is a necessary condition for dispensing with consent, but not a sufficient one: the other condition is that there be, on the site, no other third-party code that stores an identifier. The most common candidate is advertising. A network such as Google AdSense uses advertising cookies, and with it consent becomes required even if the measurement tool stays exactly the same.

This blog has already prepared for that day. The privacy policy describes Google’s advertising cookies, and the consent signals come in denied by default on every page. The ad loader, however, enters the site only when the account is activated, and to this day no ad has been served here. When that changes, the title and the opening of this post stop describing the site, and the correction needs to go in together with the activation, not afterward.

The lesson holds for any text that describes its own product: before locking in “this site does not do X,” check whether the claim depends on a decision already made and not yet carried out. Each of those decisions is the expiration date of some published sentence.

The principle, outside Cloudflare

The choice is not “install this specific tool.” It is recognizing that there are two categories of measurement, and choosing with your eyes open:

  • Measurement without an identifier (aggregated, no cookie): it measures the site, not the person. No banner required, but no individual journey.
  • Measurement with an identifier (GA, Meta Pixel, most traditional analytics): it measures the person through the site. Greater analytical power, a mandatory consent banner — and the obligation to honor the refusal for real, not only to display the banner and ignore the click on “reject.”

Before pasting in the analytics snippet that every tutorial tells you to use, it is worth separating two questions: knowing who came back is one thing; knowing that the site works and people read is another. The first requires an identifier, a cookie, and a banner. The second does not. It is that distinction that decides the tool, and with it the existence of the banner nobody reads.

Sources

  • _ga cookie per visitor, valid for up to 2 years — Google Analytics: cookie use (official documentation), verified on 2026-07-20.
  • Measurement with neither a cookie nor fingerprinting at the edge — Cloudflare Web Analytics (official documentation), verified on 2026-07-20.
  • An identifier tied to the person as personal data — LGPD, Law No. 13.709/2018 (primary source), verified on 2026-07-20.