For many websites the real question is not "who is this visitor?" but "how many people read this page, where do they come from and what do they do next?". Answering it does not require following each individual over time. Cookieless analytics grew out of exactly that observation: tools that count visits and aggregate behaviour without storing persistent identifiers in the browser.
How classic tracking works
The traditional scheme is simple. On the first visit the analytics script generates a random identifier and writes it to a cookie that lasts months or years. On every later visit the cookie is read and the tool knows it is the same browser. That is where metrics such as "returning users", the length of the purchase cycle and multi-week attribution come from.
The price is that each visitor becomes a trail of linkable data. The longer the period and the more information piles up, the more that trail resembles a profile.
The cookieless approach
Privacy-oriented tools use different strategies, often combined:
- No persistent identifier: each page view is recorded as an isolated event, with URL, referrer, device type and a country derived from the IP address, which is then discarded.
- Daily hash: to tell unique visitors apart within a day, the tool hashes IP, user agent and domain together with a secret value (a "salt") that changes every 24 hours and is destroyed. The next day the same visitor produces a different hash and can no longer be linked.
- Immediate aggregation: some systems do not even store the raw event; they simply increment counters.
The result is a reliable statistical picture of traffic without the ability to reconstruct one person's path across weeks.
What you gain
In my work I have often seen sites load heavy analytics scripts only to check three numbers a month. A minimal tool brings concrete advantages:
- Lightweight script: a few kilobytes instead of dozens, with a measurable effect on loading.
- Less data to protect: if you do not keep IPs and identifiers, a database breach exposes far less.
- More complete data in some cases: visitors who decline cookies do not vanish from the statistics, because there is nothing on the device to decline.
- More readable dashboards: fewer metrics mean fewer distractions and more attention on what matters.
What you lose
It is only fair to say it: giving up the persistent identifier has costs.
| Question | With persistent cookie | Without cookies |
|---|---|---|
| How many visits did the page get today? | Yes | Yes |
| How many unique visitors today? | Yes | Daily estimate |
| How many visitors came back a week later? | Yes | No |
| Which campaign drove a purchase made ten days later? | Yes | Only if the purchase happens in the same session |
| Funnel within a single visit | Yes | Yes, in many tools |
For a blog, an institutional site or software documentation these trade-offs are almost irrelevant. For an online shop with long purchase cycles they can matter, so it pays to clarify first which questions you actually want to ask of the data.
The alternatives in practice
There are several families of solutions:
- Hosted, minimal tools such as Plausible or Fathom: you add a script and get an essential dashboard.
- Self-hostable open source tools such as Umami or Matomo. Matomo in particular can be configured to run without cookies and with anonymised IPs, or in a fuller mode.
- Server log analysis: no client-side script at all, just processing the requests the server records anyway.
Hosting the tool on your own servers has an extra advantage: the data never leaves your infrastructure and you decide exactly how long to keep it.
How to choose
Before installing anything, write down the five questions you want to ask of the data every month. For example:
- Which pages bring in the most enquiries?
- Which external sites send readers?
- How many people complete the request form?
- Are new pages being found through search engines?
- Is mobile traffic growing or shrinking?
If all of them can be answered with aggregate data, a cookieless tool is probably the right choice. If one of them requires recognising the same person weeks apart, consider whether the answer is really worth the cost in collected data, or whether there is another way to get it, such as simply asking "how did you hear about us?" in the contact form.
Recommended minimum configuration
Whatever tool you choose, a few settings make a difference:
- disable storage of the full IP address or truncate it immediately;
- exclude your own visits and those of your staff from the counts;
- strip URL parameters carrying personal data, such as plain-text email addresses in newsletter links;
- set a retention period for raw data and keep only aggregates beyond that threshold.
In short
- Cookieless analytics count visits and aggregate behaviour without persistent identifiers in the browser.
- Daily hashes with a rotating salt make it possible to estimate unique visitors without following them over time.
- You lose multi-day analysis, such as return visits and long attribution windows, but many sites do not need it.
- Before choosing a tool, write down the questions you want to ask of the data and check whether they truly require individual tracking.
