Privacy-Friendly Advertising: How to Run Ads Without Tracking Cookies

Privacy-friendly advertising means choosing ads based on where they appear, such as the page, the topic, and your site's audience, instead of on who the visitor is. In practice, that's a direct-sold banner: a linked image in a fixed slot, with no tracking cookies and no third-party scripts. It removes most of the tracking that consent rules are concerned with, but it doesn't automatically exempt you from privacy law, so check what applies where you and your visitors are.

Key takeaways

• Contextual ads target the page and the audience, not the individual, so no cross-site profile is needed.
• A script-free linked image sets no cookies, though the server that hosts it still receives standard request data such as the IP address.
• Fewer trackers usually means a simpler consent setup, but "no cookies" isn't the same as "no rules." This article isn't legal advice.
• Advertisers get something tracking-based ads can't promise: exactly where and when their ad appears.
• Pitch it on placement, audience fit, and honest slot-level numbers.

Behavioral ads vs. contextual, direct-sold ads

Most ad networks decide which ad to show based on what they know about the visitor, which usually means third-party scripts, cookies or similar identifiers, and a real-time auction involving several companies. Contextual, direct-sold ads work differently.

MDN's explanation of third-party cookies describes how cookies set across many sites can be combined into a detailed profile of a person's browsing, and how browsers such as Firefox and Safari now restrict them by default. Contextual ads don't depend on any of that.

How a cookie-free banner works

A cookie-free banner is an <a> link wrapped around an <img>. When the page loads, the browser requests the image from the ad server or CDN. When someone clicks, the browser goes to the advertiser's page, often through a short redirect that counts the click first.

What doesn't happen matters just as much:

• No script runs on your page, so nothing can read the page, fingerprint the browser, or load other trackers.
• The snippet stores nothing on the visitor's device and sets no identifier.
• Impressions and clicks are counted per slot as totals. Nobody needs to know who saw the ad.

The honest caveat. Any request to another server reveals standard request data, including the visitor's IP address and browser type. That's how the web works for every image, font, or video loaded from elsewhere. IP addresses can count as personal data under laws like the GDPR, so describe ad serving in your privacy policy.

What the advertiser learns. By default, modern browsers send at most your site's origin, not the full page address, when a visitor follows a link from an HTTPS page to another site, according to MDN's Referrer-Policy reference. Campaign tags such as utm_source=yoursite&utm_medium=banner identify the placement, not the person.

What it means for consent banners

This is where people overstate things, so here's a careful, general picture. It isn't legal advice, and rules vary by country and change over time.

In the EU, the ePrivacy rules require consent before storing or reading information on a visitor's device, which covers cookies and similar technologies, with narrow exceptions, such as when it's strictly necessary for a service the visitor asked for. The GDPR separately governs personal data, which can include IP addresses. The UK has similar rules, with some differences.

In the US, several state privacy laws give residents the right to opt out of the sale or sharing of their personal information, including for targeted advertising.

What cookie-free, contextual ads change. If your ads set no cookies, run no third-party scripts, and build no profiles, you've removed the tracking that advertising consent prompts usually exist to cover. Whether you still need a consent banner then depends largely on everything else on your site, such as analytics, video embeds, chat widgets, and social buttons, and on how ad impressions and clicks are counted.

What they don't change. The European Data Protection Board's guidelines on the technical scope of the ePrivacy rules, adopted in 2024, say those rules can apply beyond cookies, including to tracking pixels and tracked links. The same guidelines note that this doesn't automatically mean consent is required, because exemptions may apply case by case. Data protection law also still covers any personal data your servers or your ad server process.

Practical steps:

1. List everything on your site that sets cookies or loads third-party code. Ads are often only part of it.
2. Describe ad serving and click counting in your privacy policy.
3. Decline requests to add advertisers' tracking pixels or scripts to your pages. Offer campaign tags and slot-level reports instead.
4. Before you remove or simplify a consent banner, check the law where you and your visitors are, or ask a privacy professional.

Contextual targeting: selling placement and audience

Without personal tracking, you sell what you actually know: your content and your readers as a group.

• Sell by placement. "Sidebar on every camera review" or "leaderboard on the homepage" is a clear product. Advertisers know exactly where the ad will appear.
• Sell by topic. Group pages into sections and offer a slot per section, so a lens retailer appears next to lens reviews.
• Describe your audience in aggregate. Use what your content covers, reader surveys, and aggregated analytics, such as "mostly hobbyist photographers in the US and Europe," not individual profiles.
• Offer exclusivity. The only advertiser in a category on a section is worth paying more for.

How to explain it to advertisers

Some advertisers are used to retargeting and user-level dashboards, so frame cookie-free ads around what they gain:

• Known placement: they see the exact slot and dates before paying.
• Relevant context: their ad sits next to content about their product category.
• Transparent numbers: slot-level impressions, clicks, and CTR, plus visits and conversions in their own analytics through campaign tags.
• No surprises: their ad doesn't end up on pages they'd never choose.

A short pitch you can adapt:

Our ads are contextual and direct-sold. Your banner runs in one fixed slot, [the sidebar on our reviews section], for the dates you book. We don't use tracking cookies or third-party ad scripts, so we can't retarget, but you know exactly where your ad runs and who it reaches: [audience description]. We share slot-level impressions and clicks, and you can add UTM tags to see visits and conversions in your own analytics.

When an advertiser asks to add their own tracking pixel, explain that you keep third-party trackers off your pages for your readers' privacy, and offer UTM tags and an end-of-campaign report instead. Our guide to banner ad metrics covers what to include in that report.

A bonus: script-free ads are also much lighter, which helps page speed. See our guide to running ads without hurting Core Web Vitals.

A cookie-free setup without building it yourself

You can hand-code linked images and swap them manually, or use a tool built around the same approach. Spreadiom gives each ad slot a one-line <a><img></a> embed with no JavaScript and no cookies. Ads are served from a CDN, and impressions, clicks, and CTR are tracked per slot. Advertisers book on the slot's booking page, where they see its size, price, availability, and recent impressions and clicks, and they pay by card directly into your own Stripe account.

FAQ

Do I need a cookie banner if my ads don't use cookies?

It depends on the rest of your site and on the law where you and your visitors are. Cookie-free, script-free ads remove the tracking that advertising consent prompts usually cover, but analytics, embeds, and widgets may still need consent. EU guidance also says ePrivacy rules can reach tracking pixels and tracked links. Review everything your site loads, and check local law or ask a professional before removing a banner.

What is contextual advertising?

Contextual advertising chooses ads based on the content of the page and the audience of the site, rather than on a profile of the individual visitor. A camera retailer advertising on camera reviews is a contextual ad. It doesn't need cookies or cross-site tracking, which makes it a natural fit for direct-sold banner slots where the advertiser picks a specific placement, section, or topic.

Can I measure ad performance without cookies?

Yes. You can count impressions when the ad image is served and clicks when visitors pass through a click-counting link, then report totals for each slot. Advertisers can add UTM campaign tags to their landing page URL to see visits and conversions in their own analytics. You lose user-level tracking across sites, but you keep the numbers most direct-sold campaigns are judged on.

Are cookie-free ads automatically GDPR compliant?

No ad format is automatically compliant. Cookie-free, script-free banners avoid many common problems, such as third-party trackers and cross-site profiling, but any request to an ad server still involves standard data like IP addresses, which the GDPR can treat as personal data. Describe ad serving in your privacy policy and check your obligations with a privacy professional. This isn't legal advice.

Will advertisers pay for ads without behavioral targeting?

Many will, especially in niches where your content already attracts the right audience. Direct-sold contextual ads give advertisers something targeted network ads rarely offer: a known placement on relevant pages for specific dates, with transparent slot-level numbers. Pitch the fit between your audience and their product, show real impressions and clicks, and suggest UTM tags so they can measure outcomes themselves.