Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Panelbear is a privacy friendly, cookieless web analytics tool that reports aggregated traffic and Core Web Vitals without identifying individual visitors. It does not set tracking cookies, so in most setups it can run without a consent banner. Panelbear has since become part of Cronitor and is offered as Cronitor Real User Monitoring, keeping the same cookieless and de personalised approach.
Panelbear is a privacy friendly, cookieless web analytics tool aimed at developers who want simple, fast and lightweight measurement. It reports aggregated metrics such as pageviews, referrers, devices, countries and Core Web Vitals without identifying individual visitors. Because it does not set tracking cookies and de personalises the data it collects, most websites can run it without a cookie consent banner. The analytics script is open source, which makes its behaviour easy to audit. Panelbear has since become part of Cronitor and is now offered as Cronitor Real User Monitoring, keeping the same cookieless and privacy centric approach.
Panelbear is designed to set no tracking cookies at all, which is its defining characteristic. Instead of a persistent identifier it derives anonymous, aggregated statistics from each request, and it de personalises visitor data so that it cannot be traced back to an individual or a raw IP address. It collects the page being viewed, the referrer, broad device and browser information, approximate location at country level and performance metrics. No persistent client side identifier is stored for cross visit tracking, and no profile is built. This means there is typically nothing to list as a tracking cookie, only the open source measurement script itself.
The ePrivacy Directive requires consent for storing or reading non essential information on a device, but because Panelbear does not store cookies or device identifiers, that consent trigger generally does not apply. Under the GDPR the aggregated, de personalised measurement data is low risk, and where IP addresses are processed transiently they are not stored in identifiable form. This makes the legitimate interest basis a realistic option for many websites. National rules such as the German TTDSG focus on access to a device, which a cookieless tool largely avoids. Even so, you should confirm the current configuration genuinely avoids identifiers before relying on a no consent setup.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
In a standard cookieless configuration Panelbear does not require a consent banner, because it neither stores cookies nor identifies visitors. Many operators choose to mention it in the privacy policy under legitimate interest rather than gating it behind consent. If your organisation prefers a conservative stance, you can still place the script behind a consent management platform and load it only when an analytics category is accepted. If you ever enable a feature that stores an identifier, you must switch to a consent based approach and integrate the script with your consent platform. Document whichever choice you make so the legal basis is clear.
Panelbear, now Cronitor Real User Monitoring, is provided by a company based in the United States and processes event data on United States infrastructure, so a transfer outside the EEA takes place. Because the data is aggregated and de personalised, the impact of this transfer is limited, but it should still be covered by Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. You should record the transfer in your records of processing and mention it in your privacy policy. For stricter data residency, the relay feature lets you forward and process events on a server you control. Using the relay can keep raw personal data within your own infrastructure and reduce the transfer to aggregated results.
Confirm that your Panelbear or Cronitor configuration is cookieless and stores no identifiers, then document a legitimate interest balancing assessment. Sign a data processing agreement and review the data region and retention settings. Add a short, honest entry to your privacy policy describing the cookieless analytics and the United States processing, and consider whether to use the relay for stricter residency. Even though a banner is usually unnecessary, keep the description accurate and revisit it if the product changes. Periodically verify with browser developer tools that no unexpected cookies or storage are being written.
Websites using Panelbear must obtain user consent under GDPR regulations.
DPIA considerations
Because Panelbear is cookieless and collects only aggregated, de personalised measurement data, the privacy risk is low and a full data protection impact assessment is usually not required. You should still document a legitimate interest balancing test that records the purpose, the absence of identifiers and the limited data collected. Note that the provider is based in the United States and processes event data there, so the transfer should be covered in your records. If you enable any feature that begins storing identifiers or if you combine the data with other systems, reassess whether consent and a DPIA become necessary. The optional relay can be used to keep raw data within your own infrastructure and further reduce risk.
Sample consent text
We use Panelbear for privacy friendly, cookieless analytics. It measures aggregated traffic without cookies and without identifying you individually.
Third-party domains contacted
cdn.panelbear.comapi.panelbear.comrum.cronitor.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| No tracking cookies | none | not applicable | Panelbear, now Cronitor Real User Monitoring, is cookieless and sets no tracking cookies or persistent device identifiers. It produces aggregated, de personalised statistics from the open source measurement script without client side storage for tracking. |
Panelbear collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Panelbear is cookieless by design and sets no tracking cookies. It produces aggregated, de personalised statistics without storing a persistent client side identifier. In a standard configuration there is no cookie to list, only the open source measurement script itself.
In most setups no consent banner is required, because Panelbear does not store cookies or device identifiers and does not identify visitors. The ePrivacy consent trigger relates to accessing a device, which a cookieless tool largely avoids. You should still verify your configuration is genuinely cookieless before relying on a no consent approach.
Legitimate interest under GDPR Article 6(1)(f) is generally appropriate, because the data is aggregated, de personalised and low risk. You should document a short balancing assessment recording the purpose and the absence of identifiers. If you ever enable a feature that stores identifiers, consent under Article 6(1)(a) would be required instead.
Yes. The provider is based in the United States and processes event data on United States infrastructure, so a transfer outside the EEA occurs. The impact is limited because the data is aggregated and de personalised, and the transfer relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. The optional relay can keep raw data within your own infrastructure.
A full data protection impact assessment is usually not necessary because the processing is low risk and cookieless. A documented legitimate interest assessment is normally sufficient. Reassess if you enable identifier storage or combine the analytics with other personal data.
Confirm the configuration is cookieless, sign a data processing agreement and document a legitimate interest assessment. Add a clear entry to your privacy policy describing the cookieless analytics and the United States processing. Consider using the relay for stricter data residency and verify periodically that no cookies are written.
Other cookieless, privacy friendly analytics tools include Plausible, Fathom, Simple Analytics and Splitbee. For self hosting you might consider Umami or Matomo configured without cookies. Since Panelbear is now Cronitor Real User Monitoring, Cronitor itself is the direct continuation.
State that Panelbear is cookieless and sets no tracking cookies, then describe the aggregated, de personalised analytics under legitimate interest. Mention the United States processing and the safeguards that cover it, and reference the relay option if you use it. Review the entry if you change the configuration or if the product changes.