ePrivacy and cookie-free analytics
The ePrivacy rules cover more than cookies. Understanding what your analytics reads or stores on a visitor’s device is part of deciding whether consent is needed.
What the rules cover
Article 5(3) of the ePrivacy Directive addresses storing information on, or accessing information from, a user’s device. It generally requires consent, with exceptions for transmission and storage or access strictly necessary to provide a service requested by the user. National implementation matters. Read the directive.
The EDPB’s final technical guidance considers technologies beyond cookies, including pixels, identifiers, and some IP-based tracking. Receiving information in a request does not, by itself, establish that the activity falls outside Article 5(3). EDPB Guidelines 2/2023.
How this relates to Fathom
Fathom’s visitor analytics does not set tracking cookies. It uses request information and site-specific signatures to measure website activity. You can read the processing steps and limitations in our data journey.
That design is relevant to a privacy assessment, but it is not a universal exemption from consent. Assess the actual information collected, the purpose of collection, and the rules and regulator guidance applicable to your website. Consider other scripts and integrations as well as Fathom.
Decide how analytics should load
Document whether consent is required for your implementation or whether a local exception applies. If you need consent, make sure analytics loads only after the visitor has given it and that withdrawal is respected. If you rely on an exception, check its conditions and any notice or objection requirements.
Keep your privacy notice accurate. Where personal data is processed, GDPR responsibilities apply alongside device-access rules.
What happened to the proposed regulation?
The proposed ePrivacy Regulation was withdrawn in 2025. It should no longer be described as an imminent replacement for the directive. European Parliament legislative record.
These guides explain privacy requirements and how they relate to Fathom. They are general information, not legal advice. Your obligations depend on your website, its visitors, and how you use analytics. Contact us for information about your setup.