Do I need a cookie banner for AI agent analytics?
The snippet sets no cookies or local-storage entries and does not retain raw visitor addresses. Daily salted session hashes and deployment context still require an individual privacy and consent assessment; this guide describes the implemented data flow, not a legal guarantee.
By Gorden Wübbe · Updated 2026-09-08
Review the deployment
Inspect this snippet, other scripts on your site, server logs, hosting and the intended purpose. The absence of a cookie alone does not decide every privacy or consent question. Consult the privacy notice and your own adviser where needed.
What is recorded
Redacted page path without query string; recognized source host or token, not a full referrer URL; observed tool name, duration, technical outcome and safe error class; and a daily salted session estimate based on address and coarse browser class. Raw addresses and tool argument values are not stored.
Where it lives, and under what contract
One server in Germany. Adding a site concludes the data processing agreement under Art. 28 GDPR, which names the sub-processors, includes the EU standard contractual clauses and describes the processing as the code does it. The source is public, so a data protection officer can check the description against the implementation.
If even that is too much
Run it yourself. The software is AGPL-3.0 and installs with one compose file; the data then never leaves your own machine.
In short
Is the daily hash personal data?
Treat the hash as potentially pseudonymous personal data in a privacy assessment. A changing salt limits cross-day linkage but is not a blanket anonymity guarantee.
Is this legal advice?
No. It is a description of what the software does and the reasoning the design follows. Your own assessment, or your lawyer's, decides.