Do you need cookie consent for website visitor identification?

The short answer

In the UK and EU, usually yes. If a visitor identification tool stores or reads anything on the visitor's device, such as cookies, local or session storage, pixels or scripts, the UK's Privacy and Electronic Communications Regulations (PECR) apply, and you need consent unless an exception covers it. EU rules work the same way. "Cookieless" does not mean consent-free.

Not legal advice

This page is general information about how the rules work. It is not legal advice. Speak to your data protection officer or a data protection professional about your own set-up.

What PECR covers

The ICO says PECR "applies to any technology that stores information, or accesses information stored, on a subscriber's or user's 'terminal equipment'." In plain English: the visitor's phone, laptop or browser.

The ICO's guidance names the main technologies:

• cookies
• web storage, including local storage and session storage
• tracking pixels
• scripts and tags
• device fingerprinting

The EU has a similar rule in the ePrivacy Directive, applied by each EU country.

Are there exceptions?

In the UK, yes, but they are narrow. The ICO lists five exceptions to the consent rule: communication, strictly necessary, statistical purposes, appearance and emergency assistance. The EU has only two: sending a communication, and strictly necessary.

The UK's statistical purposes exception, sometimes called the analytics exception, lets you collect statistics to improve your website without consent, as long as you explain it clearly and give people a simple, free way to object. It does not cover visitor identification. The ICO says it "is not for identifying, tracking or monitoring people or groups of people who use your service," and that it does not apply to online advertising.

The strictly necessary exception is for things a visitor needs for the service they asked for, such as a shopping basket. The ICO says to judge this from the visitor's point of view, not yours. Identifying the company behind a visit is for your benefit rather than something the visitor asked for, so it is unlikely to fit.

What happens if you get it wrong?

The ICO enforces PECR in the UK. Since 5 February 2026, under the Data (Use and Access) Act 2025, the maximum fine for breaking PECR is £17.5 million or 4% of worldwide annual turnover, whichever is higher. Before that it was £500,000.

Cookieless vs cookie-based identification

Reverse IP lookup, matching a visitor's IP address to a company, does not need a cookie. The IP address arrives with every web request.

But most tools run a script on your website to record which pages were viewed, and many of those scripts store something on the device, even if it is not a cookie. Under PECR, it is what the script stores or reads that matters, not whether the vendor calls it cookieless. In the EU, regulators go further: they treat a script that makes the browser send information, including the IP address, as accessing the device, even if nothing is stored. Ask each vendor exactly what its tracker stores and reads, and for how long.

Cookieless tracking also does not remove your duties under GDPR. You still need a lawful basis, a privacy notice and an easy way to withdraw consent or object. See our guide to GDPR and visitor identification.

What do restrictions on third-party cookies change?

Not much for visitor identification. Third-party cookies track people across different websites, mainly for advertising. Some browsers, such as Safari and Firefox, block them by default, while Chrome still allows them. Visitor identification works on visits to your own website, from a script you added yourself, so it does not depend on third-party cookies either way.

How Warm AI's tracker works

• No cookies. The tracker sets no HTTP cookies.
• One session token. It keeps a session token in session storage, which expires after 30 minutes of inactivity and is cleared when the tab closes. It may read, but never writes, a consent setting that some cookie banners keep in local storage.
• No fingerprinting. No canvas, WebGL, font or audio fingerprinting.
• Consent first in the UK and EU. In the UK, EU, EEA, Switzerland, Quebec and other regions that require consent, the tracker waits for your cookie banner to signal consent before it records a visit. In the US, Canada outside Quebec and a few other regions, it runs without a consent gate.
• Works with common cookie banners. It detects Cookiebot, OneTrust, CookieYes, Transcend, HubSpot, Klaro, Framer's built-in banner, Google Consent Mode v2 and IAB TCF v2.

This means Warm AI only sees UK and EU visitors who accept your cookie banner, so how your banner is set up affects how many companies you see. The full technical details are in our tracker privacy notice.

How to decide

1. Ask each vendor for a written list of what its tracker stores or reads on the device.
2. Check that list against the rules and exceptions with your adviser.
3. Set up your cookie banner so the tracker only runs after consent where consent is needed.
4. Record your reasoning: whether any exception applies, your lawful basis, and how your banner is configured.

Frequently asked questions

Start your 14-day free trial. No card needed.