What is cookieless analytics?
Cookieless analytics measures website traffic without storing a cookie, a localStorage value or any other identifier on the visitor's device. Because nothing is written to the device, the EU and UK consent requirement for storage does not apply, so no cookie banner is needed. The trade-off is that visitors cannot be recognised across days.
Why removing the cookie removes the banner
The consent banner is not triggered by analytics as an activity. It is triggered by storing or reading information on someone's device. That is what the EU ePrivacy Directive regulates, and the UK PECR rules mirror it.
Take away the storage and the obligation goes with it. Analytics that sets no cookie, writes no localStorage or IndexedDB value, and does not fingerprint has nothing to ask permission for, so the banner has nothing to be about.
GDPR is a separate question about personal data. An identifier that is derived from request signals, salted with a secret, rotated daily and never reversible is generally treated as not identifying a person, which is why cookieless analytics is usually run without consent. None of this is legal advice, and your own DPO should confirm it for your setup.
How it works
How a visitor is counted without a cookie
- 1
The request arrives
A pageview reaches the analytics endpoint with the ordinary things every HTTP request carries: an IP address, a user agent, a referrer, and the page URL.
- 2
Signals are hashed with a rotating salt
The IP address, user agent and site domain are hashed together with a secret salt that is regenerated every day. The raw IP is never stored.
- 3
The same person, the same day, matches
That hash is stable for 24 hours, which is enough to recognise a returning visitor within the day and to group their pageviews into sessions.
- 4
Tomorrow the salt changes
A new salt means a new hash for the same person, so nobody can be followed across days. The inability to track long-term is a property of the design, not a gap in it.
Compared
What you get and what you give up
What cookieless cannot do
- Recognise the same person tomorrow, or next week
- Multi-day, multi-touch attribution windows
- Long individual user timelines across sessions
- Cross-device journeys without your own user id
What cookieless does well
- Accurate daily visitors, pageviews and sessions
- Full source, referrer and campaign reporting
- Funnels and conversions within a session
- Revenue attributed to the campaign that brought the visit
- No consent banner, so no traffic lost to a rejected prompt
Live demo
See it on real data. The live demo is a fully populated dashboard on demo traffic, with no signup and no card.
Open the live demoCookieless is not fingerprinting
The two get conflated, and the difference is the intent behind the design.
Fingerprinting builds an identifier meant to persist: it samples fonts, canvas rendering, screen dimensions, audio hardware and dozens of other signals precisely so it keeps working when the visitor clears everything and comes back tomorrow.
A daily-rotating salted hash is built to stop working. It samples the minimum, it is one-way, the salt is secret, and it is deliberately destroyed every 24 hours. A technique designed to fail after a day and a technique designed to survive a device wipe are not the same thing, whatever they have in common at the level of arithmetic.
What a cookieless dashboard actually shows
The common assumption is that removing cookies leaves you with a hit counter. It does not. Everything that happens inside a visit is still fully measurable, because a session does not need cross-day identity to exist.
You keep visitors, sessions, pageviews, referrers, campaigns, countries, devices, entry and exit pages, funnels, custom events and revenue per source. What you lose is the ability to say that the person here today is the person who was here last Tuesday.
For most teams that is a good trade, because the questions they actually ask are about this week's traffic and this campaign's conversions, not about individual histories.
Cookieless by default, with cookie mode when you need it
mrkr runs cookieless out of the box. There is an optional cookie mode you can switch on per site when you genuinely need cross-session identity, for example to measure 30-day retention or a long consideration cycle from a single anonymous visitor.
Turning it on changes the legal position for that site: you are now storing something on the device, so a consent banner is required there. That is a real trade and it is worth making deliberately rather than by default, which is why the default is the other way around.
The third option, and often the best one for a logged-in product, is to send your own user id with events from your backend once someone has an account. It is more accurate than any browser identifier, it survives a device change, and it rests on the account relationship you already have.
FAQ
Is cookieless analytics GDPR compliant?
Cookieless counting avoids the ePrivacy consent requirement because nothing persistent is stored on the visitor's device. Under GDPR, a salted hash that rotates daily and cannot be reversed or linked across days is generally treated as not identifying a person. This is not legal advice, and your DPO should confirm it for your configuration.
Do I still need a cookie banner with cookieless analytics?
Not for the analytics itself, in the default cookieless mode, because there is nothing persistent stored to consent to. You may still need one for other things on the site, such as advertising pixels, embedded video or a chat widget. Switching a site into cookie mode reinstates the requirement for that site.
How accurate is cookieless analytics?
Within a day it is highly accurate, often more so than cookie-based analytics, because there is no banner to reject and no first-party cookie for a browser to clear. Across days it is an estimate: a returning visitor tomorrow is counted as a new one.
What is the difference between cookieless analytics and Google Analytics consent mode?
Consent mode still uses cookies when consent is granted, and models the gap statistically when it is refused. Cookieless analytics never sets a cookie at all, so there is no gap to model and no consent decision to record.
Start with one line of HTML.Your first visitors show up within a minute.