Cookieless analytics and GDPR

What "cookieless" actually means#

Web analytics has to answer one question over and over: is this the same visitor as before? The classic answer is a cookie, a small id kept in the browser. Cookieless analytics answers it differently, without keeping anything on the device.

In trckable, turning on cookieless mode, a single switch, does four things for every visitor, wherever they live:

• Nothing is stored in the browser. No cookie, no local storage, no queue of unsent events.
• Visitors are counted with a daily hash of their IP address and browser, salted with a value that changes every day. Only today's and yesterday's salts are kept, so a hash cannot follow anyone from day to day, or from site to site.
• The region and city are dropped. The country stays.
• Do Not Track and Global Privacy Control are honoured.

And it is enforced by the server. Whatever a script cached in someone's browser sends, the server keeps no id, and a cookie it once set is expired. A cached old script cannot quietly opt a visitor back in.

The IP address is used in memory while a request is handled, to work out the country, to tell robots and floods of requests from people, and, in cookieless mode, to make the daily hash. It is not stored in a log, in the database or on disk.

What you give up#

Cookieless counting is honest about its limits, and so should you be.

A visitor also becomes a new visitor when their IP address changes, for instance from Wi-Fi to mobile data, and when their browser updates, because both feed the hash. Counts are right within a day, and across days they are a sum of days. The same limits apply to other cookieless tools that count with a daily hash.

None of this makes the numbers wrong. It means you should read them for what they are.

Two sets of rules, not one#

Most of the confusion about "cookie banners" comes from mixing two things.

The ePrivacy rules cover storing information on a visitor's device, or reading it. In the EU they come from the ePrivacy Directive (Article 5(3)), implemented differently in each country. The rule is consent first, with exemptions that vary by country, often for strictly necessary storage and, in some countries, for limited first-party analytics.

The GDPR (text) covers personal data: you need a lawful basis, you must be transparent about what you process, and people have rights over their data.

A cookie raises the first. Personal data raises the second. Going cookieless takes the cookie away, but a script that still reads the page address, the referrer, the screen width and the language and sends them is, in the view of European regulators, still accessing the device. That is why cookieless is a strong simplification and not an automatic exemption.

When a banner may still be needed#

What decides it is your country's rules and your setup, not the analytics tool alone.

• Several EU countries and the UK have exemptions for first-party analytics that meet conditions, which commonly include that visitors can object. The conditions differ.
• Germany and Austria generally still ask for consent, cookie or not.
• Outside Europe analytics rarely needs a banner. The US laws are about selling and sharing data, which trckable does not do.
• Other things on your page may need consent regardless: ads, embedded video, chat widgets, social buttons and any other tracker. A cookieless analytics script does not cover them.
• If you keep the cookie, in the EU and the UK that normally needs consent before the script runs.

These are the general lines. The rules change, and the details are national. Ask a lawyer who knows the countries your visitors are in, and read the guidance of your data protection authority.

If you keep the cookie#

You may want a stable visitor across days, and the cookie is how you get it. Then you need to ask first. trckable supports three positions:

The last two work with Google Consent Mode v2 and IAB TCF v2.2, or with a call from your manager's callback: trckable('consent', true).

Whichever you pick, the same rules hold:

• Until the visitor answers, what the page sends waits in the browser's memory. Nothing is sent and nothing is stored.
• If they accept, the waiting page goes, with the cookie, and so does everything after it.
• If they decline, the waiting page is dropped and nothing more is sent. A visitor who declines is not counted at all.
• If they leave without answering, the page they saw is counted without a cookie, the way cookieless mode counts it.
• A banner's default ("denied" before anyone has clicked) is not an answer. Only a click is.

trckable's own bar makes refusing as easy as agreeing, and a visitor who sends Do Not Track or Global Privacy Control is never asked and never counted. It is not a full consent management platform: it has no vendor list and no consent log with proof of who agreed to what. If you need those, run a CMP and let trckable read it. The details are in the consent docs.

What trckable does, and what stays with you#

trckable is built so that you can meet GDPR. Here is what it does:

• No IP address is stored in a log, the database or the write-ahead log.
• Nothing loads from another company. No fonts, CDN, pixels, tag managers or error reporting from anyone else, and no telemetry.
• EU hosting on Cloud: servers in Amsterdam and backups in the EU. A data processing agreement is published.
• Retention you control: from 30 days to 3 years per site, pruned daily.
• Data requests: find, export or erase everything held about one visitor id or one email address.
• A privacy paragraph written from your settings, which changes when you turn a module off or switch cookieless mode on.
• Open source, so anyone can read what it does.

And what stays with you:

• Deciding your lawful basis and whether you need consent, in the countries you serve.
• Your banner: making refusing as easy as agreeing, and covering everything else on your page.
• What you send: goal properties hold whatever you put in them, so do not put personal data there.
• Reading the generated privacy paragraph before you publish it. It is a starting point from people who are not your lawyers.

A short checklist#

1. List your visitors' main countries.
2. List everything on your pages that stores or reads something on the device: analytics, ads, video, chat, fonts from a CDN.
3. Decide per country whether you rely on an exemption or on consent, with your counsel.
4. Pick the position: cookieless, trckable's bar, or reading your banner.
5. Turn on cookieless mode in Settings → Data & privacy, or set up the bar.
6. Read the generated privacy paragraph and put it in your policy.
7. Check on a page: open your browser's storage tools and confirm what is stored.

Questions#

Does cookieless analytics make me compliant with GDPR?

Compliance belongs to how you use a tool, not to the tool. trckable is built for GDPR, and cookieless mode removes the cookie and drops the region and city, but we do not promise that your use of it is compliant, and nothing here is legal advice.

Do I need a cookie banner for trckable?

In cookieless mode the script stores nothing on the visitor's device, which removes a reason to ask. Several countries exempt first-party analytics under conditions, while Germany and Austria generally still ask for consent. If you keep the cookie, asking first is normal in the EU and the UK. Check with your counsel.

Is a daily hash anonymous?

Do not assume so. The hash is a pseudonymous identifier for the day. Because the salt changes daily, and only today's and yesterday's are kept, it cannot be recomputed later from an IP address, but regulators may still treat a hash as personal data while it exists. That is one reason trckable keeps the claims modest.

Does trckable store IP addresses?

No. The address is used in memory while a request is handled and is not written to a log, the database or disk. A keyed hash of it sits in memory for up to ten minutes so one machine cannot flood a site, and the key exists only in the running process.

What about Do Not Track?

In cookieless mode, Do Not Track and Global Privacy Control are honoured: those visits are dropped before anything is stored. In cookie mode it is a setting you can turn on.

Can I use trckable with a consent manager I already have?

Yes. Choose "Read my banner", and trckable reads Google Consent Mode v2 or IAB TCF v2.2. A visitor who declines is not counted.

Keep reading#

• Privacy in the docs: what is recorded and what is refused
• Consent in the docs
• Accuracy: what cookieless counting can and cannot count
• trckable's privacy policy