Two tiers of consent, or analytics that store nothing

The banner is not the problem

A typical cookie banner offers a choice between two bad options. Either it blocks the page until you click, or it is designed so that consenting is the only comfortable exit. Both rest on the same assumption: that without consent you can know nothing.

That assumption is false, and that is the whole point of this post. Consent is required to write something to a visitor's device and to recognise them across visits. It is not required to count how many times a page was opened.

Two states of the same library

The entire difference fits in a handful of configuration lines, and there is nothing clever about it:

no answer / denied             after clicking "Allow"
-----------------             ----------------------
persistence: "memory"         persistence: "localStorage+cookie"
person_profiles: "never"      person_profiles: "always"
autocapture: false            autocapture: true
capture_heatmaps: false       capture_heatmaps: true
session_recording: off        session_recording: on (inputs masked)

The left column writes zero bytes to the device. The right one writes an identifier that outlives the browser session. That is the only thing the banner is asking about, which is why the question is not whether to collect data but whether to leave anything on your hardware.

Three things that are normally on by default are off here: automatic interaction capture, click maps and session replay. That is not cosmetic. Those three collect the behaviour of a specific person rather than a page count, so they wait for an explicit decision.

Do not take our word for it

The difference between these tiers is checkable rather than declarative, and that is the substance. A claim nobody can verify is worth exactly as much as trust in whoever made it, which is the same mistake we write about in the context of AI agent security. So check:

• Open this site in a private window and do not click the banner.
• Open devtools, the Application tab in Chrome or Storage in Firefox.
• Look at Cookies and Local Storage for arklink.co. Nothing of ours is there, in particular no key beginning with ph_.
• Click Allow, reload, and look again. Now the identifier exists, because that is what we asked about.

If you run a site and want the same: check whether your analytics tool has a cookieless mode with in-memory persistence, and whether autocapture and replay are genuinely disabled in it rather than merely unused. Those are two different states, and only one of them lets you honestly write that you store nothing before consent.