Measuring without a cookie banner rarely works for a Belgian website, not even with a cookieless tool. The rule applies to any technique that stores or reads information on the device, and Belgium has no exception for analytics cookies [1], [2]. Without consent, you still have your own business figures, strictly necessary cookies and reports that don't depend on a tag.
Guidance from the Netherlands and France often says something different, because those countries do have an exception. Whether you set up your measurement yourself or have it reviewed by a Google Analytics agency: start from the Belgian rule. This is an explanation, not legal advice.
What can you measure without consent?
More than you think, as long as it doesn't depend on a tracker on your visitor's device:
- Strictly necessary cookies, such as for load balancing, sessions, the language choice, cookie preferences or the shopping cart [1].
- Your own figures: orders, quote requests, phone calls and revenue per product, from your webshop, accounting or CRM.
- A question in your form. "How did you hear about us?" is old-fashioned, but works without a single tracker.
- Reports that don't depend on a tag on your site. Search Console shows clicks and impressions in Google's search results [3], and Google Ads counts the clicks on your ads.
With those figures of your own, you can also estimate your blind spot: compare them every month with the key events in GA4. If the ratio stays stable, the difference is mainly consent. Don't extrapolate the conversion rate of consenting visitors to everyone, because according to Google those visitors typically convert 2 to 5 times more often than those who refuse [4].
Fewer cookies also means fewer signals for your advertising platforms. What that means for audiences on Meta is explained by Jonas in Audiences on Meta after iOS and cookies: what still works?.
Which options do you have, and what is allowed?
| Option | What you miss | Status in Belgium |
|---|---|---|
| GA4 with basic Consent Mode | Everything from those who refuse: nothing goes to Google [5] | In line with the DPA, if your banner meets the checklist |
| GA4 with advanced Consent Mode | Detailed behaviour of those who refuse; Google models with cookieless measurement data [5] | Risk: the tags load before the choice and send information from the device |
| Cookieless analytics tool | Returning visitors and conversion paths, depending on the tool | The script is in principle covered by the rule [6]; have it assessed legally |
| Server log analysis | Everything that happens in the browser | Undecided: using IP addresses and protocol data to track visitors may fall under the rule [6] |
| Server-side tracking | Nothing extra | Consent remains necessary, just as with client-side |
What basic and advanced do exactly is explained in Consent Mode v2 in practice: basic or advanced?. Why server-side is no way out is covered in Server-side tracking explained. If a vendor says you don't need a banner with their tool, ask which country that claim is based on.
A pragmatic approach for an SME: a banner that meets the DPA checklist, a deliberate choice between basic and advanced Consent Mode, and measuring against your own figures every month. A cookieless tool only comes after a legal assessment, and never as a reason to remove your banner.
Why cookieless doesn't mean consent-free
In Belgium, the cookie rule is in Article 10/2 of the Framework Act of 30 July 2018. By "cookies", the Belgian Data Protection Authority (DPA) also means other tracking technologies, such as a pixel, device fingerprinting or local storage [1]. There is no exemption for cookies that count visitors, not even for first-party cookies [2].
The European regulators (EDPB) read the underlying rule, Article 5(3) of the ePrivacy Directive, just as broadly. According to them, JavaScript that makes the browser send data is clearly covered, as are tracking pixels, tracking links and, in certain cases, tracking based on the IP address [6]. A cookieless tool still runs such a script.
According to the EDPB, the fact that the rule applies doesn't automatically mean you need consent: that depends on the exceptions [6]. In Belgium they are narrow: technical storage to transmit a communication, and cookies that are strictly necessary for a service the visitor explicitly asked for [1].
Why Dutch and French guidance doesn't hold here
The Netherlands and France have an exception that Belgium doesn't have. The DPA itself confirms that some regulators in other member states exempt such cookies under strict conditions [2].
| Country | Analytics measurement without consent? |
|---|---|
| Belgium (Framework Act, DPA) | No, not even for first-party cookies [1], [2] |
| Netherlands (Telecommunications Act, Autoriteit Persoonsgegevens) | Yes, for limited analytics cookies with little or no impact on privacy [7] |
| France (loi Informatique et Libertés, CNIL) | Yes, for anonymous audience measurement solely for the publisher itself, without linking to other processing [8] |
A French-language version of your site doesn't automatically make you subject to the French rules: the CNIL exemption is based on French law [8]. If you are established in Belgium and target Belgian visitors, start from the Belgian rule.
What Europe may change
The European Commission's Digital Omnibus proposal of 19 November 2025 contains an exception for aggregated audience measurement [9]. It applies to the provider of a service, solely for its own use (Article 88a, paragraph 3, point c). It also regulates the banner: refusing with one click, and after a refusal not asking again for the same purpose for at least six months [9].
But it is a proposal. On 27 September 2026, the European Parliament listed the status of this file as "Awaiting committee decision" [10]. Until there is a final text and it becomes applicable, the current rule applies in Belgium.
Want to know what happens today with visitors who refuse? The free tracking audit checks whether your banner passes the consent signals correctly and on time, and which tags fire before someone makes a choice.
Frequently asked questions
Can I use Google Analytics without a cookie banner?
Not for a Belgian website. The Belgian DPA states that there is no exemption for cookies that count visitors, not even for first-party cookies. Without consent, Google Analytics may therefore not place or read cookies. With basic Consent Mode, you only load Google Analytics after consent.
Is a cookieless analytics tool allowed without consent?
Not automatically. The Belgian rule also applies to pixels, fingerprinting and local storage, and the European regulators read it broadly. A script that sends measurement data from the browser is in principle covered. Whether it can still run without consent depends on what the tool does: have it assessed legally.
Why do I read that it is allowed in the Netherlands or France?
Because those countries have an exception that Belgium doesn't. In the Netherlands, limited analytics cookies with little or no impact on privacy are allowed without consent. In France, the CNIL exempts audience measurement under strict conditions. The Belgian DPA confirms that such exceptions exist elsewhere, but not in Belgium.
Is advanced Consent Mode a way to measure without consent?
No. Advanced Consent Mode loads the Google tags before your visitor chooses and, on a refusal, sends measurement data without cookies to Google, so that Google can model. Because the device sends information in the process, that carries a legal risk. It is no substitute for consent.
Is a European exception for audience measurement coming?
Possibly. The European Commission's Digital Omnibus proposal of 19 November 2025 contains an exception for aggregated audience measurement, solely for the provider's own use. On 27 September 2026 that proposal had not yet been adopted. Until it becomes law, the current Belgian rule applies.
Sources
- Cookie-checklist — Gegevensbeschermingsautoriteit (Belgian Data Protection Authority), 17 Oct 2023, accessed 27 Sep 2026
- Als u cookies voor publieksmeting (ook wel statistische of analytische cookies genoemd) wilt installeren en/of lezen, heeft u dan toestemming nodig van de gebruiker van uw website of applicatie? — Gegevensbeschermingsautoriteit (Belgian Data Protection Authority), 17 Nov 2023, accessed 27 Sep 2026
- Performance report (Search results): Overview and basic setup — Search Console Help, accessed 27 Sep 2026
- About consent mode modeling — Google Ads Help, accessed 27 Sep 2026
- Consent mode overview — Google for Developers, 30 Jul 2026, accessed 27 Sep 2026
- Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0 — European Data Protection Board, 7 Oct 2024, accessed 27 Sep 2026
- Cookies — Autoriteit Persoonsgegevens (Netherlands), accessed 27 Sep 2026
- Cookies : solutions pour les outils de mesure d'audience — CNIL (France), accessed 27 Sep 2026
- Proposal for a Regulation (Digital Omnibus), COM(2025) 837 final — European Commission (EUR-Lex), 19 Nov 2025, accessed 27 Sep 2026
- Procedure file 2025/0360(COD): Simplification of the digital legislative framework (Digital Omnibus) — European Parliament, Legislative Observatory, accessed 27 Sep 2026