Measuring links without cookies: what the GDPR changes (and doesn't)

"You can't measure anything without a cookie banner any more." We hear it often. It is not true for a link shortener, as long as you choose what you measure.

What a short link needs to know

To answer "did my campaign work?", you need to count visits and know where they come from. Not who made them. At Bref, a visit is:

• the date and time, the link, the source (click or QR scan);
• the country and city, approximately derived from the network;
• the device type, system and browser, read from the header every browser sends;
• the site the visitor came from, reduced to its domain;
• during an A/B test, the version served.

That's all. No IP address kept, no identifier, no tracking cookie. Nobody can be recognised or followed from one visit to the next.

Less detail over time

Visit-by-visit detail serves one purpose: the CSV export. It is erased after 30 days. Beyond that, Bref keeps only totals per hour and per day (how many visits from Belgium, how many from an iPhone), viewable for up to 3 years depending on your plan. A total says nothing about anyone.

The GDPR still applies

No cookie does not mean no rules. A city and a phone type are still information about people. In practice:

• You are the controller for visits to your links, and Bref acts on your behalf. Our data processing agreement describes what we do, where, and for how long.
• Inform your visitors in your privacy policy if you use measured links in your campaigns.
• Limit the use: campaign analytics, not profiling.

With no cookie and nothing read from the phone's storage, redirecting a Bref link does not normally trigger the consent banner requirement. If your situation is special (sensitive sector, data combined with other tools), ask your DPO or a lawyer: this article is not legal advice.

What about your UTM parameters?

UTMs are not cookies: they are words in the address. Bref adds them to the destination, and your site's analytics tool reads them. If that tool sets cookies, it is the one that must ask for consent, not the link.

In short

Measuring less often means measuring better. Knowing that 60% of your poster's scans come from Namur on a Saturday afternoon helps you more than a visitor ID, and makes nobody uncomfortable.