Analytics cookies are the ones nobody expects to be a problem. They are usually first party, the data mostly stays with a tool you pay for, and the purpose is to understand your own site rather than to follow anyone around the web. That reasonable intuition is exactly what the European rule declines to accept, because the test it applies is not whether the storage is reasonable but whether it is strictly necessary to deliver what the visitor asked for, and knowing how many people read your pricing page is not.
The test that catches them
The ePrivacy rule exempts storage that is strictly necessary for the service the user requested. A basket that forgets its contents does not work; a site whose owner cannot count visitors works perfectly well from the visitor's point of view. That asymmetry is the whole of it, and it is why every European regulator that has looked at plain analytics has reached the same conclusion regardless of how privacy-preserving the tool claims to be. Some national authorities have carved out narrow exemptions for strictly aggregate first party measurement with no sharing, which is worth checking for your own markets, but the default is that consent is required.
What happens to the numbers
Once the tag genuinely waits for consent, the reported traffic falls by the share of visitors who decline, and on a European audience that share is not small. The important thing is that the fall is a measurement change rather than a business change: the same people visited. Sites that do not prepare for this end up with a marketing team convinced the site broke in the week the banner was fixed. Note the date the gating shipped in the analytics annotations, and compare like with like afterwards.
Consent mode and modelled data
The major tag platforms now accept a consent signal and adjust their own behaviour rather than simply not firing, sending pings without identifiers when analytics consent is absent and modelling the gap. This is useful and it is not a way around the rule: the signal still has to be driven by a real decision, and the mode has to be set before the tags load rather than after. If you use it, verify in the browser that the default state is denied on a fresh visit, because the common misconfiguration is a default of granted that is never corrected.
Server side measurement does not sidestep it
Moving collection to your own server changes who sees the request and not what is stored on the device. If a value is written to or read from the visitor's browser to make the measurement work, the rule applies. Server side is worth doing for reliability and for control over what leaves your infrastructure; it is not worth doing in the belief that it removes the banner question, and vendors who imply otherwise are selling an interpretation nobody has tested.
What to do on a small site
Decide whether you need visitor-level analytics at all. A surprising number of small company sites are running a full analytics suite to answer questions that server logs or a cookieless aggregate tool would answer, and swapping the tool removes the category from the banner entirely. If you do need it, put it behind the analytics category, make refusing genuinely easy, and accept that the number you get is the number of people who agreed to be counted.
Questions people ask about analytics cookies
Do analytics cookies need consent in the United States?
Not on the same basis. There is no US equivalent of the ePrivacy storage rule; the question is whether what the analytics feeds is sold or shared under a state privacy law, which turns on your arrangements with the vendor rather than on the cookie.
Is a privacy-focused analytics tool exempt?
Sometimes, if it genuinely stores nothing on the device. Read the technical documentation rather than the marketing page, and check the storage panel yourself, because several tools that describe themselves as cookieless still write something.
Can I put analytics under strictly necessary?
No, and doing it is one of the most common findings in a banner audit. The category exists for storage the service cannot run without.