Do I need a cookie banner for AI agent analytics?
Consent under the ePrivacy rules is for storing or reading something on the visitor's device. Agent Tracking stores nothing there: no cookie, no local storage, no fingerprint. The session id is a hash of a value that changes daily, the address is not kept, and the data stays on a server in Germany under a data processing agreement.
By Gorden Wübbe · Updated 2026-09-08
What triggers consent, and what does not
The banner obligation attaches to access to the terminal device: cookies, local storage, and techniques that read device characteristics to build a fingerprint. A script that sends the page path and the referrer host, and keeps no identifier that survives the day, does not touch the device in that sense. That is the reasoning cookieless analytics rests on, and it is the reasoning here.
What is recorded
Page path without query string; referrer host and utm_source only when they name an assistant; tool name, duration, outcome, error class and input key names; a session id computed from a daily random salt, the domain, a coarse browser class and the address, hashed to 16 characters. The address itself is not stored.
Where it lives, and under what contract
One server in Germany. Adding a site concludes the data processing agreement under Art. 28 GDPR, which names the sub-processors, includes the EU standard contractual clauses and describes the processing as the code does it. The source is public, so a data protection officer can check the description against the implementation.
If even that is too much
Run it yourself. The software is AGPL-3.0 and installs with one compose file; the data then never leaves your own machine.
In short
Is the daily hash personal data?
It is treated as pseudonymous data and processed on the site owner's behalf under the DPA. It cannot be linked across days and cannot be resolved to a person, because the input that would allow it, the address, is not stored.
Is this legal advice?
No. It is a description of what the software does and the reasoning the design follows. Your own assessment, or your lawyer's, decides.