Panelbear

What Panelbear is

Panelbear is a privacy friendly, cookieless web analytics tool aimed at developers who want simple, fast and lightweight measurement. It reports aggregated metrics such as pageviews, referrers, devices, countries and Core Web Vitals without identifying individual visitors. Because it does not set tracking cookies and de personalises the data it collects, most websites can run it without a cookie consent banner. The analytics script is open source, which makes its behaviour easy to audit. Panelbear has since become part of Cronitor and is now offered as Cronitor Real User Monitoring, keeping the same cookieless and privacy centric approach.

Cookies and data it collects

Panelbear is designed to set no tracking cookies at all, which is its defining characteristic. Instead of a persistent identifier it derives anonymous, aggregated statistics from each request, and it de personalises visitor data so that it cannot be traced back to an individual or a raw IP address. It collects the page being viewed, the referrer, broad device and browser information, approximate location at country level and performance metrics. No persistent client side identifier is stored for cross visit tracking, and no profile is built. This means there is typically nothing to list as a tracking cookie, only the open source measurement script itself.

GDPR and ePrivacy implications

The ePrivacy Directive requires consent for storing or reading non essential information on a device, but because Panelbear does not store cookies or device identifiers, that consent trigger generally does not apply. Under the GDPR the aggregated, de personalised measurement data is low risk, and where IP addresses are processed transiently they are not stored in identifiable form. This makes the legitimate interest basis a realistic option for many websites. National rules such as the German TTDSG focus on access to a device, which a cookieless tool largely avoids. Even so, you should confirm the current configuration genuinely avoids identifiers before relying on a no consent setup.

Consent requirements and CMP integration

In a standard cookieless configuration Panelbear does not require a consent banner, because it neither stores cookies nor identifies visitors. Many operators choose to mention it in the privacy policy under legitimate interest rather than gating it behind consent. If your organisation prefers a conservative stance, you can still place the script behind a consent management platform and load it only when an analytics category is accepted. If you ever enable a feature that stores an identifier, you must switch to a consent based approach and integrate the script with your consent platform. Document whichever choice you make so the legal basis is clear.

International data transfers

Panelbear, now Cronitor Real User Monitoring, is provided by a company based in the United States and processes event data on United States infrastructure, so a transfer outside the EEA takes place. Because the data is aggregated and de personalised, the impact of this transfer is limited, but it should still be covered by Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. You should record the transfer in your records of processing and mention it in your privacy policy. For stricter data residency, the relay feature lets you forward and process events on a server you control. Using the relay can keep raw personal data within your own infrastructure and reduce the transfer to aggregated results.

Practical compliance steps

Confirm that your Panelbear or Cronitor configuration is cookieless and stores no identifiers, then document a legitimate interest balancing assessment. Sign a data processing agreement and review the data region and retention settings. Add a short, honest entry to your privacy policy describing the cookieless analytics and the United States processing, and consider whether to use the relay for stricter residency. Even though a banner is usually unnecessary, keep the description accurate and revisit it if the product changes. Periodically verify with browser developer tools that no unexpected cookies or storage are being written.