Cookieless analytics: how counting without cookies actually works

A cookie is a small file a website stores in your browser so it can recognize you next time. Traditional analytics tools use one to tell returning visitors from new ones. Cookieless analytics tools count visitors without storing anything in the browser — some by computing a temporary code that self-destructs daily, some by refusing to identify visitors at all and only counting events. The prize is real: no stored identifier can mean no consent banner in some jurisdictions, and nothing for privacy features to delete. The cost is just as real: a tool that can't recognize anyone can't tell you whether your visitors ever come back.

Vendors use the same word for genuinely different designs. It's worth knowing which one a tool uses, because they fail in different ways.

Daily-rotating hashes. Plausible combines the visitor's IP address and browser signature with a random value, scrambles them into an anonymous code, and throws the random value away every 24 hours — in their words, 'a random string of letters and numbers that is reset every 24 hours', with raw IP addresses never stored. Fathom works similarly, holding its hash in memory and discarding it daily. Within one day, the tool can tell your 100th pageview came from 40 people. Tomorrow, those same 40 people are strangers again.

No identifiers at all. Simple Analytics and Umami go further: no hash, no code, nothing that links two pageviews to the same person. They count events — pageviews, referrers, campaign clicks — and stop there.

Counting at the edge. Cloudflare Web Analytics measures traffic on its own network before it reaches individual-level storage, and states it doesn't track people 'by IP address, User Agent, or any other fingerprinting technique'. Matomo sits in between: cookies are on by default, and a cookieless mode swaps them for a short-lived hash while warning you, in its own documentation, about 'reduced accuracy of unique visitor counts'.

A number of analytics products, Bigdelta among them, offer a cookieless option alongside a fuller tracking mode, so the choice between the two philosophies can be a setting rather than a migration.

Every cookieless design pays the same core price. Without a durable identifier, returning visitors disappear: someone who visits Monday and again Thursday is two visitors, and the 'new vs returning' report either vanishes or stops meaning anything.

Retention and cohorts are off the table. 'Do readers who arrive from the newsletter come back more often?' requires recognizing people across days. No cookieless tool can answer it.

Multi-day attribution collapses. A visitor who clicks your ad on Tuesday and buys on Friday shows up as an unrelated conversion. Same-session attribution works fine; anything longer breaks. Cross-device journeys were never possible anyway — cookies don't follow people from phone to laptop either — but cookieless tools can't paper over it with logins unless you add your own user accounts into the mix.

If your questions are 'how much traffic do I get, from where, and what do people do during a visit', you lose nothing that matters. If your questions involve loyalty, repeat behavior, or long buying cycles, you lose exactly the thing you were measuring.

Run a cookieless tool next to GA4 on the same site and the cookieless one will usually report substantially more visitors. One independent study cited widely in this space found GA4 capturing about 56% of actual traffic, and the mechanics behind the gap are well documented: GA4 only counts visitors who accept the consent banner, and nearly half of desktop visitors never interact with a banner at all. A tool that needs no consent counts them all.

Neither number is 'the truth'. GA4 undercounts because consent losses hide real people. Cookieless tools overcount unique visitors because they recount the same person on each new day. The pageview totals are the trustworthy part on both sides; the 'unique visitors' figures are two different estimates built on two different compromises. This is one more reason analytics tools never agree with each other — and note that cookieless doesn't fix ad-blocker losses, since a blocked script counts nothing regardless of how it would have counted.

This is the claim on every cookieless vendor's homepage, and the honest answer in 2026 is: it depends on where your visitors are, and the ground is still shifting.

France is the clearest case. The regulator (CNIL) publishes a formal exemption for audience-measurement analytics that meet strict conditions — first-party only, no profiling, truncated IPs, aggregated reporting — with a self-assessment scheme for vendors since January 2026. Several cookieless tools qualify. Google Analytics never has.

The UK narrowed rather than opened. The ICO's April 2026 guidance allows a statistical-purposes exemption only when the data is used solely for statistics; feed it into ad targeting or conversion tracking and consent is required again. Germany is the strictest of the large markets: regulators there read the law as requiring opt-in for analytics in most configurations, and German legal commentary treats even hashed identifiers with skepticism.

And that skepticism is the real caveat to the whole category. Vendor no-banner claims rest on the theory that a hashed, daily-deleted identifier is not personal data. European courts and regulators have been narrowing that theory — France's top administrative court upheld a €40 million fine against ad-tech firm Criteo in a case where pseudonymized identifiers tied to browsing data were treated as personal data, and recent EU case law points the same direction for hashed identifiers generally. Tools that keep no identifier at all sit on firmer ground than tools that hash one. No cookieless analytics vendor has been fined as of this writing; the point is that 'GDPR-compliant, no banner needed' is a vendor's legal opinion, not a settled rule.

A lot of cookieless marketing leans on 'cookies are going away'. They aren't — at least, the relevant ones aren't. The cookie deprecation saga was about third-party cookies, the cross-site tracking kind, and Google abandoned even that plan in 2024. The first-party cookies that analytics tools set for your own site work fine in every browser and are not being deprecated by anyone. The genuine pressure on cookie-based analytics comes from consent banners and the traffic they cost you, and from ad blockers — regulation and user choice, rather than browser roadmaps.

Pick cookieless when your questions are about traffic, content, and campaigns measured within a visit — most content sites, portfolios, early-stage products, and any site where adding a consent banner would cost more traffic than the extra metrics are worth. Pick cookie-based (or identified) analytics when repeat behavior is the business: subscription products, long sales cycles, anything where 'did they come back?' is the metric. Some teams run cookieless measurement for the public site and identified analytics inside the logged-in product, which answers both sets of questions without pretending one tool does everything.