Cookie-Free Restaurant Analytics That Comply With KVKK and GDPR

An 18-table cafe in Istanbul's Beyoglu district wanted to measure how guests interact with its QR menu — without ever asking for cookie consent. The fix was a two-tool stack: Plausible Analytics and Cloudflare Web Analytics, both engineered to skip cookies, LocalStorage and IP retention.

Why Cookie-Free Matters

Both KVKK Article 5 and GDPR Article 6 require explicit consent for personal-data processing. Cookies, fingerprints, raw IPs — all count as personal data. To skip the banner entirely you have to stay inside the anonymous aggregate boundary: counts of pageviews, devices and countries, never individual identifiers.

Plausible is open source, hosted in the EU, and stores zero personal identifiers. Cloudflare Web Analytics relies on edge sampling with a daily-rotating salt — so even hashed values cannot be linked across days.

Setup: 10 Minutes for 18 Tables

The cafe rolled out the stack in three steps. First, a Plausible account, domain registration (cafe.menu) and the script tag pasted into thMenu's "custom code" admin panel. Second, Cloudflare Web Analytics was flipped on from the dashboard. Third, DevTools verification: no cookies, no IndexedDB entries, no LocalStorage keys.

• Plausible script weighs ~1 KB and loads async; zero Core Web Vitals impact.
• Cloudflare RUM auto-reports LCP, INP and CLS for every QR scan.
• No client identifier — DevTools Application tab stays empty after navigation.

Privacy Notice Template

The cookie banner goes away, but a privacy notice is still required. The cafe's notice lists data categories (aggregated pageviews, country, device type), purpose (menu optimization), retention (24 months aggregate in Plausible), transfer (Hetzner Germany under SCCs), and rights (KVKK Art. 11, GDPR Art. 15-22).

The hard line: any single IP or device identifier that survives processing breaks the anonymous-aggregate exemption. The cafe re-audits Plausible's "no IP storage" claim annually using their public transparency report.

FAQ

Does GA4 cookieless mode count? No — GA4 still mints a client_id and pushes data to US servers, which requires an extra SCC + DPIA round under KVKK.

Can I track conversions? Yes — Plausible Custom Events captures anonymous events like "PDF download" or "WhatsApp click" without user IDs.

What does it cost monthly? Plausible's 10K-pageview plan is about $9/mo; Cloudflare Web Analytics is free. The Beyoglu cafe spends roughly $110/year.

Found this helpful? Share it.