It depends which identity mode your site is on, and the answer is different for the default.
This page is written to be handed to a lawyer. It is not legal advice, and we are not in a position to give you any — what it does is state precisely what TrueStat does on each mode, so that someone qualified can answer for your jurisdiction.
The short version
| Mode | Stores anything on the visitor's device? | Banner |
| First-party cookie (default) | Yes — one cookie | Likely required in the EU/UK |
| Rotating hash | No | Not required for TrueStat |
| Strict cookieless | No | Not required for TrueStat |
The default mode sets a cookie
The default script writes one cookie, ts_vid, on your own domain. It holds a
random UUID and nothing else.
It is about as benign as a cookie gets:
First-party. Set on your domain, readable only there.
No personal data. A random value with no meaning outside our system.
Not shared. Not sold, not passed to any third party, not used for advertising, not joined to anything.
Site-scoped. The value is hashed with your site's id before storage, so the same browser on two customers' sites is two unrelated identifiers and no cross-site profile can be built.
None of that exempts it under the EU ePrivacy rules.
Those rules are about storing or accessing information on a user's device — not about whether the information is personal data. The exemptions are narrow: strictly necessary for a service the user requested, or purely for transmitting a communication. Analytics is generally read as falling outside both. Several national regulators have published guidance permitting some first-party analytics without consent under tight conditions; those conditions vary by country and are not something we can assert on your behalf.
The practical position most people land on: a persistent first-party analytics cookie needs disclosure, and in the EU and UK usually consent.
If you have seen "no cookie banner needed" attached to TrueStat, it is true of the two cookieless modes below and it is not true of the default.
The cookieless modes store nothing
On rotating hash and strict cookieless, the script writes no cookie, no
localStorage, no sessionStorage, no IndexedDB — nothing on the device at all.
Identity is computed on our servers from the request and the IP is discarded.
Nothing is stored or accessed on the visitor's device, so the ePrivacy storage rules do not engage. TrueStat gives you no reason to show a banner.
This does not mean your site needs no banner. If you run any other script that stores something — an embedded video, a chat widget, a payment provider, another analytics tool, a font that phones home — that is a separate question and this page cannot answer it.
What the cookieless modes cost you
Real, and worth weighing before you switch:
New vs returning visitors is unavailable. The identifier does not persist across days.
A visitor is recounted each day. Someone who reads a post on Monday and comes back Thursday is two visitors, not one returning visitor.
Nothing links a visit to one weeks later. "This post drove a signup a month later" is unanswerable.
A session crossing midnight UTC counts as two visitors.
Strict cookieless additionally undercounts uniques, because visitors sharing a network merge into one.
Detail in Identity and cookieless mode.
How to switch
Site settings → identity mode → save. It takes effect immediately, per site.
The server decides which mode runs, from your site's setting rather than from the tag on your page — so you cannot end up on the wrong mode by pasting a stale snippet, and you do not have to redeploy your site to switch.
Historical data is not rewritten, so expect a step in your visitor numbers around the switch.
If you keep the default
Two things to do:
Disclose it. Your cookie notice or privacy policy should say that you use TrueStat for analytics, that it sets one first-party cookie containing a random identifier, that no personal data is collected, and that no data is shared with third parties.
Wire consent to the tag if your jurisdiction requires it. The simplest approach is not to render the tag until consent is given. Because there is no cookie and no request before the script loads, an unloaded tag stores nothing and sends nothing.
If your consent tool can only unblock scripts after the fact, note that the first page view is lost — the script has to be present at load time to record it. Switching that site to a cookieless mode is usually the better answer: it needs no consent gate at all and you keep the first page view.
What we do not know about your site
We cannot tell you whether your site needs a banner, because it depends on everything else on the page, on where your visitors are, and on your regulator's current guidance. What we can tell you is exactly what TrueStat does, which is the whole of this page and What we store, and what we don't.