Cookieless analytics
Also known as no-cookie analytics, consent-free analytics
4 min read · updated 2026-09-09
Definition
Cookieless analytics measures site usage without storing an identifier on the visitor's device. Where no personal data is stored or read from the device, most jurisdictions do not require a consent banner — which is the practical reason most people adopt it.
How a session works without a cookie
The usual approach is a rotating daily hash: combine a salt that changes every day with the visitor's IP, user agent and the site identifier, hash the result, and use that as the session key. Two requests from the same person on the same day produce the same key; tomorrow they do not, because the salt has changed.
The IP is never stored — only the hash — and yesterday's salt is discarded, which makes re-identification after the fact impossible rather than merely discouraged. That last property is what separates this from hashing as a formality.
What it costs
Cross-day identity, and therefore returning-visitor counts and any funnel spanning more than a day. Those are real losses, and a product claiming cookieless measurement with no accuracy trade-off is not describing the same technique.
What is unaffected: page views, referrers, entry pages, geography at country level, and everything about crawler traffic — a crawler carries no cookie either way.
The consent question
The requirement in the EU comes from the ePrivacy Directive and concerns storing or accessing information on a device, which is broader than cookies and narrower than "collecting data". Not writing to the device is what removes the trigger.
That is a general description rather than legal advice, and the analysis differs by jurisdiction and by what else your site does. Any vendor giving you a flat guarantee about your compliance is overreaching.
What a visitor can verify for themselves
The claim "we do not track you" is made by every analytics vendor, and a visitor has no way to check most of it. A few parts are checkable, and a product making the claim should be able to point at them.
**Browser storage.** Open developer tools and look at cookies, local storage and IndexedDB for the site. A cookieless tracker leaves nothing; anything that does is storing an identifier whatever the marketing says.
**The requests themselves.** The network tab shows what is sent. A payload carrying a stable identifier, a full URL with query parameters, or anything resembling an email address is doing more than page measurement.
**Third parties.** How many other domains the page contacts, and which. A privacy claim from one vendor means little on a page loading four other trackers.
What a visitor cannot check is what happens server-side — whether the IP is retained, how long, and whether the salt really rotates. Those are promises, and they are only as good as the vendor. Which is an argument for the promises being specific and testable rather than reassuring: "the salt rotates daily and yesterday's is deleted" can be falsified by a subpoena; "we respect your privacy" cannot.
What goes wrong
- Assuming cookieless means anonymous. A hash of an IP is still personal data in some readings if the inputs can be reconstructed — the rotating salt and the discarded history are what close that.
- Comparing cookieless numbers against cookie-based history and reading the difference as a traffic drop.
- Expecting returning-visitor metrics to survive.
Worth doing
- Say plainly which metrics you lose. A reader who finds out later trusts the rest less.
- Keep the salt rotation and the deletion of old salts — without them the technique is a formality rather than a property.
Questions
- Is cookieless analytics GDPR-compliant?
- Compliance depends on your whole processing, not on one tool. What cookieless changes is the consent-banner requirement under ePrivacy, which is triggered by storing or reading data on a device — and that is what a cookieless design avoids.
- How accurate is it compared with cookie-based tracking?
- Equivalent within a day, weaker across days. Page views, sources and entry pages are unaffected; returning visitors and multi-day journeys are the parts that genuinely degrade.
- Do I still need a privacy policy?
- Yes. A privacy policy describes what you collect and why, and you are still collecting something. What cookieless changes is the consent banner, which is triggered by storing or reading data on the device — a narrower question than whether you process personal data at all.
See which AI assistants are reading your site.
AI crawlers take your HTML and leave without running a line of JavaScript, so a browser tag records nothing. TrueStat reads them server-side, checks each address against what the operator publishes, and shows you which pages were fetched — including the ones that returned a 404.