Cookie-free analytics: how it works and what it cannot tell you

"Cookie-free analytics" has become a common promise. It sounds simple, but there are real trade-offs behind it, and it helps to understand them before you choose a setup for your website.

What normal analytics stores

Traditional analytics recognises a returning visitor by storing an identifier on their device, usually in a cookie or in the browser's local storage. Each time the visitor loads a page, the identifier is sent along, so the tool can tell that ten pageviews came from one person rather than ten.

That identifier is what makes reports like "returning visitors", "days to conversion" and multi-session journeys possible. It is also what privacy rules in many countries focus on, because storing or reading information on someone's device often requires their consent.

How cookie-free counting works

Cookie-free analytics stores nothing on the device. Instead, the server builds a short-lived identifier from information that comes with every request anyway:

1. It takes the visitor's IP address and browser user agent.
2. It combines them with the website and a secret salt that changes every day.
3. It hashes the result, producing a value that cannot be turned back into the IP address.

Requests from the same browser on the same day produce the same hash, so pageviews can be grouped into visits and visitors. The next day the salt changes, the old salt is deleted, and the same person produces a completely different hash. Nobody, including the analytics provider, can link the two days or recover the original IP address.

What you gain

• Nothing stored on the visitor's device. No cookie, no local storage, nothing to clear.
• No long-term profile. Because identifiers reset daily, there is no history of a person across weeks or months.
• Simpler compliance in many cases. Many site owners run cookie-free analytics without a consent banner. Whether that is right for you depends on your jurisdiction, your audience and the other tools on your site, so check your own obligations or ask a qualified adviser.

What you give up

Being honest about the limits is important:

• Returning visitors across days. Someone who visits on Monday and again on Thursday counts as two visitors.
• Multi-day journeys. You cannot see that a visitor read a blog post on Monday and bought on Thursday.
• Shared networks. Several people behind the same office IP address with the same browser version can occasionally be counted as one visitor on a given day.
• Some precision on counts. Daily visitor totals are reliable estimates, while weekly and monthly unique visitor totals will be higher than with persistent IDs, because the same person is counted once per day.

For most questions site owners actually ask, such as which pages work, where traffic comes from and what converts, these limits matter much less than they sound.

Questions to ask any analytics provider

Whichever tool you use, these questions tell you more than a "privacy-friendly" badge:

1. Is the IP address ever stored? Not "anonymised later", but never written to disk.
2. Is the cookie-free mode enforced on the server, or does it depend on the script on your page?
3. Are Do Not Track and Global Privacy Control respected, and is that checked on the server?
4. What does the tool capture from forms? It should never record what visitors type.
5. If session recording exists, what is masked, and is masking repeated on the server?

How our analytics handles it

In our analytics, cookie-free mode is a per-site setting. With it on, the tracker stores nothing in the browser and visitors are counted with a hash of a daily salt, the site, the IP address and the browser; salts are deleted every day. The server enforces the mode too, so it holds even if an old copy of the script is cached somewhere. IP addresses are never stored in any mode, form values are never collected, and Do Not Track and GPC are honoured by default.

You can read exactly what we collect on our privacy by design page, or start a free trial with cookie-free mode switched on from the first day.