What is cookieless analytics?
Cookieless analytics measures traffic without storing anything on the visitor's device, so no consent banner is required. How it works and what it costs.
What is cookieless analytics?
Cookieless analytics measures website traffic without storing a cookie, a localStorage value or any other identifier on the visitor's device. Because nothing is written to the device, the EU and UK consent requirement for storage does not apply, so no cookie banner is needed. The trade-off is that visitors cannot be recognised across days.
Why removing the cookie removes the banner
The consent banner is not triggered by analytics as an activity. It is triggered by storing or reading information on someone's device. That is what the EU ePrivacy Directive regulates, and the UK PECR rules mirror it.
Take away the storage and the obligation goes with it. Analytics that sets no cookie, writes no localStorage or IndexedDB value, and does not fingerprint has nothing to ask permission for, so the banner has nothing to be about.
GDPR is a separate question about personal data. An identifier that is derived from request signals, salted with a secret, rotated daily and never reversible is generally treated as not identifying a person, which is why cookieless analytics is usually run without consent. None of this is legal advice, and your own DPO should confirm it for your setup.
How a visitor is counted without a cookie
- 01
The request arrives
A pageview reaches the analytics endpoint with the ordinary things every HTTP request carries: an IP address, a user agent, a referrer, and the page URL.
- 02
Signals are hashed with a rotating salt
The IP address, user agent and site domain are hashed together with a secret salt that is regenerated every day. The raw IP is never stored.
- 03
The same person, the same day, matches
That hash is stable for 24 hours, which is enough to recognise a returning visitor within the day and to group their pageviews into sessions.
- 04
Tomorrow the salt changes
A new salt means a new hash for the same person, so nobody can be followed across days. The inability to track long-term is a property of the design, not a gap in it.
What you get and what you give up
What cookieless cannot do
- Recognise the same person tomorrow, or next week
- Multi-day, multi-touch attribution windows
- Long individual user timelines across sessions
- Cross-device journeys without your own user id
What cookieless does well
- Accurate daily visitors, pageviews and sessions
- Full source, referrer and campaign reporting
- Funnels and conversions within a session
- Revenue attributed to the campaign that brought the visit
- No consent banner, so no traffic lost to a rejected prompt
See it on real data
The live demo is a fully populated dashboard with real demo traffic. No signup and no card required.
Open the live demoCookieless is not fingerprinting
The two get conflated, and the difference is the intent behind the design.
Fingerprinting builds an identifier meant to persist: it samples fonts, canvas rendering, screen dimensions, audio hardware and dozens of other signals precisely so it keeps working when the visitor clears everything and comes back tomorrow.
A daily-rotating salted hash is built to stop working. It samples the minimum, it is one-way, the salt is secret, and it is deliberately destroyed every 24 hours. A technique designed to fail after a day and a technique designed to survive a device wipe are not the same thing, whatever they have in common at the level of arithmetic.
What a cookieless dashboard actually shows
The common assumption is that removing cookies leaves you with a hit counter. It does not. Everything that happens inside a visit is still fully measurable, because a session does not need cross-day identity to exist.
You keep visitors, sessions, pageviews, referrers, campaigns, countries, devices, entry and exit pages, funnels, custom events and revenue per source. What you lose is the ability to say that the person here today is the person who was here last Tuesday.
For most teams that is a good trade, because the questions they actually ask are about this week's traffic and this campaign's conversions, not about individual histories.
Cookieless by default, with cookie mode when you need it
Mrkr runs cookieless out of the box. There is an optional cookie mode you can switch on per site when you genuinely need cross-session identity, for example to measure 30-day retention or a long consideration cycle from a single anonymous visitor.
Turning it on changes the legal position for that site: you are now storing something on the device, so a consent banner is required there. That is a real trade and it is worth making deliberately rather than by default, which is why the default is the other way around.
The third option, and often the best one for a logged-in product, is to send your own user id with events from your backend once someone has an account. It is more accurate than any browser identifier, it survives a device change, and it rests on the account relationship you already have.
Questions, answered.
Related terms.
- What is cookieless tracking?
Cookieless tracking is any method of recognising visits without storing an identifier in the browser.
- What is cookie banner?
A cookie banner is the notice that asks a visitor's permission before storing or reading information on their device.
- What is first-party data?
First-party data is information you collect directly from your own audience on your own properties: site behaviour, purchases, support conversations, and anything customers tell you.
- What is unique visitor?
A unique visitor is one person counted once within a reporting period, no matter how many times they visit or how many pages they view.
- What is server-side tracking?
Server-side tracking sends analytics events from your own backend rather than from the visitor's browser.
Where this shows up in Mrkr
- How Mrkr does analytics without cookies
The mechanism, the legal reasoning, and a setup you can copy.
- Open a live cookieless dashboard in the demo
- Browse the full analytics glossary
Every metric, method and privacy term, defined in one place.
Your first visitor is already here.
Drop in the script and watch them land. It takes about a minute.