Website analytics without cookies.

By default: no cookie, no localStorage, no fingerprint, and therefore no consent banner. Here is the mechanism, the legal reasoning, the honest trade-off, and what changes if you turn cookie mode on.

Do I need a cookie banner for analytics?

Only if the analytics stores or reads something on the visitor's device. The EU ePrivacy rule governs storage on terminal equipment, not measurement itself. Analytics that sets no cookie, touches no localStorage, and does not fingerprint has nothing to ask consent for, so no banner is required.

This is the part most teams get wrong. The banner is not triggered by “you are doing analytics”. It is triggered by “you are writing to my device”. Remove the writing and the obligation goes with it.

What a cookieless visitor actually looks like.

Cookieless does not mean anonymous mush. A visit still carries its source, its pages, its device, its engagement, and its events.

What it does not carry is a name that survives to tomorrow. The handle you see is stable for one day on one site, and then it is gone by construction.

The Mrkr visitor list with per-visitor session detail.
The visitor list, with per-visitor session detail. Open it in the live demo.

How a visitor is counted with no cookie.

Derived, not handed out

IP, user agent, site, and a secret salt are hashed together. The IP goes into the hash and is discarded, never stored.

The salt rotates every 24 hours

That is what separates this from fingerprinting. The same visitor hashes to a different value tomorrow.

Built to expire, not to persist

Daily uniques are accurate and cross-day identity is impossible by construction. The only thing kept on the device is a per-tab session key the browser discards when the tab closes, which cannot recognise anyone on a later visit.

What each approach actually stores.

Cookie-based analyticsFingerprintingCookieless (Mrkr)
Writes to the deviceYes, a durable cookieReads the device insteadA per-tab session key, gone when the tab closes
Consent banner required in the EUYesYes, and it is worseNo
Identifier lifespanMonths to yearsDesigned to persist24 hours
Can follow a person across daysYesYesNo
Stores raw IPOftenOftenNo, hashed and discarded
Survives a cleared browserNoUsually yesn/a
Accurate daily visitor countsYesYesYes
Multi-day attribution windowsYesYesNo

Cookieless numbers, on real traffic

Every figure in the live demo was collected the way this page describes: a salted signal that rotates daily, no cookie, no banner. Open it and see what that gives you.

Open the live demo
The Mrkr overview dashboard showing visitors, sources, and top pages over time.

What you actually gain.

The traffic the banner was eating

Decliners are never a random sample. Removing the banner removes a systematic skew, not just lost volume.

A faster first paint

A consent manager is 30 to 80 kB of blocking JavaScript. Deleting it usually beats anything you do to your own bundle.

A shorter procurement review

No cookies means no cookie table in the privacy policy, and a much shorter answer to the legal questionnaire.

The two modes, side by side.

Cookie mode, a per-site option in Mrkr

  • A first-party cookie that lasts a year, so one person is recognised across days and weeks
  • Multi-day and multi-session attribution windows
  • More accurate returning-visitor counts
  • A consent banner is required, and the data lost to it comes back with it

Cookieless mode, the default

  • No cookie and nothing that outlives the tab, so no consent banner is required
  • A salted signal that expires every 24 hours by construction
  • Accurate daily uniques, sources, campaigns, pages, funnels, and revenue
  • No cross-day identity, so long consideration windows cannot be measured
  • Within one session attribution is intact; across sessions it is not, so multi-touch windows are out

Questions, answered.

Keep reading

Your first visitor is already here.

Drop in the script and watch them land. It takes about a minute.