Cookieless tracking: methods, accuracy and consent

What going cookieless actually means

A cookie is a small text file a website asks the browser to store. Classic analytics puts an ID in a cookie the first time you visit, then reads it back on every later visit. That’s how a tool knows the person reading your blog today is the same person who read it last month.

It measures traffic without that stored ID. The visit still gets counted. Pages viewed, where the visitor came from, the device type and so on can all be recorded. What changes is how, or whether, the tool links one visit to the next.

Tracking and cookies are often treated as the same thing, but they aren’t. Cookies are one tool for recognising a browser. You can track without them, and you can use cookies for things that have nothing to do with tracking, like keeping items in a basket.

Cookieless tracking methods

Different tools take different routes. Here are the common ones at a high level. Most real products combine more than one.

Aggregate counting

The simplest approach: count events and don’t try to recognise anyone. Each page view adds one to a tally for that page, along with the referrer and a few other details. Nobody gets an ID.

This works well for “which pages are popular” and “where does traffic come from”. It can’t tell you how many different people visited, or what one person did across several pages.

Short-lived or rotating identifiers

Some tools create a temporary identifier from information that arrives with every request anyway, such as the IP address and the browser’s user agent string, mixed with a secret value. The result is usually passed through a one-way function called a hash, so the raw details aren’t kept.

The key part is that the secret changes regularly, often daily, and the old one is thrown away. Within that window, the tool can tell that ten page views came from the same visitor. Once the secret rotates, that visitor looks brand new, and yesterday’s identifier can’t be linked to today’s.

Server-side processing

In cookieless server-side tracking, the work happens on the server rather than in the browser. The page sends a small message about the visit, or the server reads its own request logs, and the counting and grouping happen there. Nothing is written to the visitor’s device. Server-side processing is a broad label, though: some server-side setups still rely on cookies, so “server-side” and “cookieless” aren’t the same promise.

What doesn’t count

Browser fingerprinting, which combines lots of small device details to build a persistent ID that follows someone without a cookie, is technically cookieless. It’s also exactly the kind of covert tracking privacy rules are aimed at. When people talk about privacy-friendly cookieless analytics, fingerprinting is the thing they mean to avoid.

Accuracy: what you gain and what you lose

Going cookieless changes some numbers more than others. A quick way to think about it:

Metric	Effect of going cookieless
Page views	Little or no change
Traffic sources	Little or no change for the first page of a visit
Visits within a day	Usually close
Unique visitors over a week or month	Less precise, often higher
New vs returning visitors	Hard or impossible
A visit today linked to a purchase next week	Hard without some other link

Here’s an example. Say a yoga studio’s site is visited by the same person on Monday, Wednesday and Friday. A cookie-based tool would count one visitor with three visits. A tool with a daily rotating identifier would count three unique visitors, because it can’t connect the days. Over a month, the unique visitor figure creeps up.

There are other edges too. Several people behind one office or home connection can share an IP address and get merged together. One person whose phone switches between wifi and mobile data can be split in two.

Is that a problem? It depends on what you use the numbers for. Most small businesses make decisions from trends and sources, not from an exact head count. And cookie-based numbers aren’t perfect either: people clear cookies, switch devices, browse privately and decline consent banners. A cookie-based tool that only runs after consent may be missing a large share of your visitors entirely.

Consent: cookieless doesn’t mean exempt

This is where many articles oversell. Cookieless does not automatically mean no consent banner. The rules depend on where you and your visitors are.

In the EU, the consent rule people associate with cookies comes from the ePrivacy Directive. It doesn’t actually mention cookies by name. It covers storing information on, or reading information from, a user’s device. Some regulators read that broadly, so techniques such as local storage, tracking pixels or certain kinds of device fingerprinting can fall under it even though no cookie is involved. The European Data Protection Board has published guidance taking this wider view.

Separately, the GDPR applies whenever you process personal data, and IP addresses usually count. So a cookieless tool still needs a lawful basis, a clear privacy notice and sensible retention limits, even where no consent banner is needed.

Some regulators have also set out conditions under which purely statistical audience measurement can be exempt from consent. France’s CNIL is a well-known example. The conditions tend to be strict: data used only for statistics, not shared, not combined with other data, and kept for a limited time.

The practical point: going cookieless can reduce what you need consent for, and in some places may remove the need for it in analytics, but check the rules that apply to you and ask a qualified adviser if you’re unsure. Our cookieless analytics page has more general background. This is general information, not legal advice.

Cookieless tracking on WordPress

If you’re choosing a cookieless analytics tool for a WordPress site, a few questions will tell you a lot:

1. Does it store anything in the browser? Cookies are only one option. Local storage and session storage are storage too.
2. Where does the data go? A cookieless tool can still send everything to an outside company. Pairing cookieless with first-party analytics, where data stays on your own server, removes that extra party.
3. How are IP addresses handled? Kept in full, shortened, or discarded after processing?
4. Can you turn on cookies later, with consent? Some sites want better returning-visitor data and are happy to ask for it.
5. How long is data kept, and can you delete one visitor’s records?

Analyzine is cookieless by default. If you want more detail on returning visitors, there’s an optional cookie mode that only starts after the visitor consents, and it works with CookieYes, Complianz and the WP Consent API.

Getting the most from cookieless data

Lean on the numbers it measures well. Page views, top pages, referrers and campaign tags hold up. If you run a newsletter, tag your links with UTM parameters so the visits show up under the right campaign without needing to recognise anyone. Watch trends week to week rather than fretting over exact unique visitor counts, and when you compare against an older cookie-based tool, expect the visitor figures to differ.

Frequently asked questions