Consentless website analytics by default

Consentless mode, explained

TWIPLA’s consentless mode is called Maximum Privacy Mode. It is the default, and it is what lets TWIPLA run without a cookie banner. Below is what it does and how TWIPLA justifies it legally.

Read the Data Processing Agreement

How visitors are counted

Instead of a cookie, TWIPLA recognizes visitors with a hash of their IP address and user agent. This hash works as a pseudonymous visitor identifier and stays the same as long as the visitor’s IP address and browser stay the same.

Unique visitor numbers are therefore approximate. Visitors who share an IP address and browser count as one, and a visitor whose IP address changes counts as new.

Because the hash can in principle be linked back to an IP address, we treat it as pseudonymous personal data under the GDPR, not as anonymous data.

Diagram: the IP address and user agent are combined into a one-way SHA-256 hash, which is stored as one visitor. The IP address is not stored, and nothing is stored on the visitor’s device.

How it works

Maximum Privacy Mode uses only what a browser sends with every ordinary page request. It stores nothing on the device and creates no fingerprint.

Area	What happens in Maximum Privacy Mode
Cookies, Local Storage, Session Storage	None are set or read.
Fingerprinting	No fingerprint is computed. Fonts, color depth, installed plugins and similar device properties are not queried.
Data used	Information the browser sends with every page request: user agent, language preference, requested URL, referring URL.
IP address	Used in memory for geolocation (approximate city/region via a locally hosted MaxMind GeoIP database) and company identification, then discarded. The IP address is never stored.
Visitor recognition	The server computes a SHA-256 hash of the IP address and user agent. Only this hash is stored. See “How visitors are counted” above.
Profiling	The page history of individual visitors is not available. Only aggregated data is processed.
Heatmaps and session recordings	Available. Form inputs are masked in recordings. Mouse movements and interactions are recorded in the context of § 25 TDDDG (ePrivacy Directive).

The legal reasoning

Two separate sets of rules apply to website analytics in the EU: device access rules (ePrivacy) and data protection rules (GDPR). Maximum Privacy Mode (MPM) was developed, with legal review, to avoid the consent requirement under the relevant rules. It keeps the processing under the second minimal.

“Consentless” means no consent banner is needed to run TWIPLA in Maximum Privacy Mode. It does not mean data protection law stops applying.

Screenshot of TWIPLA’s Maximum Privacy Mode (Data Privacy Level 4): mode uses cookies, no; applied identification technology, none; visitor consent needed for tracking, no; IP address tracking, no.

1. Device access

Art. 5(3) ePrivacy Directive and § 25 TDDDG (Germany)

The ePrivacy Directive Art. 5(3) and Germany’s TDDDG § 25 require consent when information already stored on the user’s end device (the website visitor’s browser) is to be accessed, for example through a JavaScript query. These rules apply whether or not personal data is involved. Conversely, no consent is required to access information that is not already stored there.

Maximum Privacy Mode reads no information already stored on the device and no device properties. It relies only on information the browser sends with every request anyway, and on information generated at runtime. On that basis, consent under these rules is not required.

Art. 5(3) ePrivacy and § 25 TDDDG. Maximum Privacy Mode stores nothing on the device and reads no stored information.

2. Processing of personal data

General Data Protection Regulation (EU)

The GDPR governs what happens to personal data that may be received, processed and stored. In Maximum Privacy Mode, this covers two things:

the IP address, processed briefly in memory and then discarded
the pseudonymous visitor hash

The legal basis for this processing is legitimate interest under Art. 6(1)(f) GDPR. The interest is understanding how a website is used, without profiling individuals. No consent is required for this basis. Transparency and the right to object still apply, as with any processing.

Art. 6(1)(f) GDPR, legitimate interest. The IP address is used, then discarded, and only the pseudonymous hash is stored.

Privacy modes, opt-out and hosting

Maximum Privacy Mode is one of four available modes, and the most privacy-friendly of the four. The other three collect more detailed data and usually require consent. Whichever mode you choose, you can offer visitors an opt-out linked from your privacy policy. All data collected by TWIPLA is hosted exclusively in Germany.

Mode	Fingerprinting	IP address stored	Visitor page history	Consent (usually) required
Maximum Privacy	No	No	No	No
GDPR Privacy	Yes	No	No	Yes
Medium Privacy	Yes	No	Yes	Yes
Light Privacy	Yes	Yes	Yes	Yes

Detailed breakdown: GDPR and ePrivacy Directive (TDDDG)

Area	GDPR	ePrivacy (TDDDG)
Cookie Banner	No cookies, local storage, session storage or other data are stored on the visitor’s device, so there is nothing that requires consent (Art. 6(1)(a), Art. 4(11), Art. 7 GDPR).	No information already stored on the end device (browser) is retrieved, so no consent under § 25 TDDDG is required.
“Technically necessary” exception	Not relied upon, and not required.	Not relied upon, and not required.
HTTP Request Fields	See the individual fields below.	No consent is needed for values the browser sends without being asked. Per the DSK (German Data Protection Conference) guidance, access requires a targeted transmission that the user did not initiate. (See DSK guidance, page 9)
HTTP Request Field / IP Address	Used to measure the website’s reach. Processed on the fly in volatile memory by a local MaxMind GeoIP installation and converted to latitude and longitude. The IP address is then discarded and never stored. The location data is imprecise by nature and shown on the map with an adjusted margin of error. Legal basis: legitimate interest in the website’s geographic reach.	Does not apply (sent without being requested)
HTTP Request Field / User Agent	Used to measure the website’s reach. Also used together with the other request fields to generate a one-way visitor hash, which is not used for profiling.	Does not apply (sent without being requested)
Other Request Fields (Language, URL, Referrer)	Used to measure the website’s reach. Processed as part of the visit. No profiling takes place.	Does not apply (sent without being requested)
Visitor Hash	A one-way hash generated from the HTTP request fields. Not used for profiling purposes.	Does not apply (no device access)
Server Log Files	No server logs are created that could contain IP addresses or later re-establish a personal reference by combining unique values.	No logs containing retrieved device information that would require consent.
Fingerprinting	Does not apply	No JavaScript fingerprinting takes place at all.
Profiling	No profiling: pages visited and their order are not tracked in a way that allows an individual to be identified. Only aggregated data is processed and provided.	Does not apply
Session Recordings & Heatmaps	Built from the operator’s HTML source and from images and media loaded from the operator’s server in player mode, plus mouse events.	Mouse events (x-y coordinates, scrolling, clicks, mouse wheel) are not information already stored on the device, so no consent is required.
Screen Resolution	Does not apply	Querying it via JavaScript would require consent under the ePrivacy Directive, so it is not done. Instead, CSS media queries let the browser report a resolution range on its own. Currently only about 20 predefined ranges are shown, not exact resolutions.

Your checklist as a website operator

Maximum Privacy Mode removes the need for a consent banner for TWIPLA. It does not remove your other obligations as controller:

Sign TWIPLA's Data Processing Agreement.
Describe TWIPLA in your privacy policy: the legal basis (Art. 6(1)(f) GDPR), brief IP processing, the visitor hash, the features you use, and hosting in Germany.
If you use the dual tracking code, say plainly that visitors who decline cookies are still counted without cookies.
Optionally, enable the opt-out and link it from your privacy policy.
Record the processing in your record of processing activities, including a short legitimate-interest assessment.

Legal consultation

TWIPLA is advised by Reed Smith Munich, in particular the Privacy, AI & Data Security Team led by Dr. Andreas Splittgerber. If you have any legal questions or are interested in our solution, contact us at consentless@twipla.com. We’re happy to help!

Legal questions? Ask us directly at consentless@twipla.com. TWIPLA is advised by Reed Smith Munich.