What is cookieless analytics, and how does it count visitors?

The problem a cookie solves

Every analytics tool has to answer one question again and again: is this request from someone I have already counted? A page view alone cannot tell. The usual answer is a cookie, a random id the browser sends back on every visit. With it, ten page views are one visitor. Without it, they look like ten.

A cookie also does something you may not want: it recognises a person across days, which is exactly what makes it personal data in the eyes of European law, and the reason a banner is asked for. Cookieless analytics gives up the "across days" to remove the cookie.

How it counts without one

Take trckable, which has a single switch for this. With it on, a visit is identified by a hash of the visitor's IP address and browser, salted with a value that changes every day. Only today's and yesterday's salts are kept. That has three consequences:

1. Two page views from the same browser on the same day produce the same hash, so they count as one visitor.
2. Tomorrow the salt is different, so the same browser produces a different hash. Nothing links the two days.
3. The hash cannot be recomputed later. Once a salt is deleted, even with the original address in hand you cannot reproduce the hash.

The IP address itself is used in memory while the request is handled (to work out the country, to tell robots from people, to make the hash) and is not written to a log, the database or disk. Nothing is stored in the browser: no cookie, no local storage, no queue. The server enforces it, so an old cached script cannot quietly switch a cookie back on. The details are in the privacy docs.

Other tools use the same family of idea with their own details. What they share is the shape: a daily-changing salt, a hash, and no id on the device.

What it is not

It is not fingerprinting. Fingerprinting tries to build an id that stays the same for a person over weeks, from dozens of browser traits, precisely so it can follow them without a cookie. A daily salted hash is built to do the opposite: it is useless the day after. The European Data Protection Board's guidelines on the technical scope of the ePrivacy rule (guidelines 2/2023) are about any technique that stores or reads information on a device, not only cookies. So the difference between the two is not "legal versus illegal". It is whether a person can be followed.

It is not server-log analytics. Reading access logs also needs no cookie, but logs keep the IP address and see robots as visitors. Cookieless tools still run a small script, so they can record the screen width, the time on page and the goals you define.

It is not automatically anonymous. A hash that exists for a day is still a pseudonymous identifier while it exists. Regulators may treat it as personal data for that day, and so you should read claims of "fully anonymous" with some suspicion, ours included.

What you give up

The seven days in Safari are WebKit's rule: Intelligent Tracking Prevention caps the expiry of client-side cookies at seven days (WebKit). That is why a cookie set by JavaScript is a weaker promise than it looks, and why the gap between "cookie" and "cookieless" is smaller in Safari than the 400-day figure suggests.

Two more things move a visitor's hash within a day: their IP address changing (Wi-Fi to mobile data) and their browser updating. Both make one person count twice. So treat the daily visitor count as a good estimate, not a census.

What stays accurate

Most of what you actually look at does not need to follow anyone:

• Page views, top pages, referrers, countries, devices and campaigns are counted per visit, and are the same with or without a cookie.
• Visitors per day are right to within the limits above.
• Goals such as a sign-up are counted when they happen. What you lose is crediting a sale to a visit from last week.

If you sell something, that last point matters, and it is the honest cost of cookieless mode: a purchase can only be tied to a visit from the same day.

Do Not Track and Global Privacy Control

In trckable's cookieless mode, a visit that sends Do Not Track or Global Privacy Control is dropped before anything is stored. That is a choice the tool makes, not a rule of cookieless counting, so check what yours does.

Choosing

Go cookieless when you want the simplest privacy position, your numbers are about pages and sources more than about long journeys, and a sale rarely depends on a visit from an earlier day. Keep the cookie, and ask first, when you need returning visitors or attribution across days. Both are supported: see consent.

Questions

Does cookieless analytics need a cookie banner?

Not automatically. Removing the cookie removes one reason to ask, but the rules also cover reading information from the device, and national rules differ. Germany and Austria generally still ask. See cookieless analytics and GDPR and ask a lawyer about your visitors' countries.

Is a daily hash a unique visitor?

For that day, yes, roughly. It can split one person in two (an IP change) or merge two people who share an address and the same browser. Across days, no: the hash changes.

Can I turn it on for only some visitors?

In trckable the switch applies to every visitor of a site, wherever they live. The alternative is to keep the cookie and ask first.

How do I turn it on?

In Settings, Data & privacy, switch on cookieless mode for the site. If you use the script tag, your site's own script already carries the setting. In a React or Next.js app, pass cookieless to the component: see how to track Next.js without cookies.