What is cookieless tracking?
Cookieless tracking identifies visits without browser storage. The four methods in use, how they differ on accuracy, and which avoid a consent requirement.
What is cookieless tracking?
Cookieless tracking is any method of recognising visits without storing an identifier in the browser. The main approaches are rotating salted hashes of request signals, server-side session identifiers, authenticated user ids you supply yourself, and device fingerprinting. Only some of them avoid a consent requirement, and fingerprinting does not.
A worked example.
The same visitor, four methods, one week.
| Daily rotating hash | 7 different identifiers, one per day |
|---|---|
| Server-side session id in a first-party cookie | 1 identifier, and a consent requirement |
| Your own user id after login | 1 identifier, accurate, no browser dependency |
| Device fingerprint | 1 identifier, persistent, and consent is required in the EU |
Only the first method both avoids storage and avoids persistence
Cookieless is not one technique. Two of these are privacy-preserving, one is an account relationship, and one is tracking by another name.
The four methods
They are grouped under one label and they behave very differently. The column that decides most architecture debates is the last one.
| Method | How identity is derived | Cross-day | Consent needed in EU |
|---|---|---|---|
| Rotating salted hash | Hash of IP, user agent and domain with a secret salt regenerated daily | No, by design | Generally not, since nothing is stored |
| Server-side session id | Issued by your server, usually in a first-party cookie | Yes | Yes, it is still storage on the device |
| Authenticated user id | Your own account id, sent with events | Yes | Covered by your account terms, not ePrivacy |
| Device fingerprinting | Canvas, fonts, hardware and dozens of other signals combined | Yes, and it survives clearing data | Yes, and regulators treat it as equivalent to a cookie |
The ePrivacy rules govern storing or accessing information on terminal equipment. Fingerprinting is explicitly in scope for reading device information, which is why calling it cookieless does not make it consent-free.
Why the industry moved
Third-party cookies were the foundation of cross-site advertising measurement, and they have been removed or restricted almost everywhere. Safari blocks them and caps script-set first-party cookie lifetimes to seven days. Firefox isolates them by site. Chrome now surfaces a user choice.
First-party analytics cookies survive but are less durable than teams assume: an ITP-capped cookie means a visitor returning after eight days is counted as new, which quietly inflates unique visitor counts and truncates attribution windows.
At the same time consent enforcement tightened, and refusal rates on properly implemented banners are high. A tool that only measures consenting visitors is measuring a biased sample of your traffic.
Cookieless methods sidestep both problems by not depending on browser storage at all. What they cannot do is manufacture cross-day identity out of nothing, and any vendor claiming to have solved that without storage is describing fingerprinting.
See it on real data
The live demo is a fully populated dashboard with real demo traffic. No signup and no card required.
Open the live demo
What to check before believing a cookieless claim
Does it write anything durable to the device?
Open the browser devtools, load the page and inspect cookies, localStorage, sessionStorage and IndexedDB. Cookies, localStorage and IndexedDB should be empty. A per-tab sessionStorage key that the browser destroys when the tab closes is normal and is what most cookieless tools use to stitch a single visit together: Mrkr writes one. What matters is that nothing survives the tab, because persistence across visits is what turns an identifier into a tracking identifier.
How long does the identifier live?
A rotation period of 24 hours is the common standard. Anything longer, or an identifier that survives a browser restart, is closer to fingerprinting than to hashing.
Is the salt secret and rotated?
Without a secret salt, a hash of IP and user agent is trivially reversible by anyone who can guess the inputs. The salt is what makes it one-way in practice.
How many signals does it collect?
Two or three coarse signals is hashing. Canvas rendering, installed fonts, audio context and screen metrics is fingerprinting, whatever the marketing page calls it.
How Mrkr does it
Mrkr's default is the first method: a hash of IP address, user agent and site domain combined with a secret salt that rotates daily. The raw IP is never stored, nothing is written to the browser, and the identifier stops working after 24 hours.
For sites that genuinely need cross-session identity there is an optional cookie mode, enabled per site. It gives you long attribution windows and multi-day visitor recognition, and it does require a consent banner on that site. Mrkr does not fingerprint in either mode.
For logged-in products, sending your own user id with events is usually better than either option: it is accurate, it survives device changes, and it rests on a relationship the visitor already agreed to.
Questions, answered.
Related terms.
- What is cookieless analytics?
Cookieless analytics measures website traffic without storing a cookie, a localStorage value or any other identifier on the visitor's device.
- What is first-party data?
First-party data is information you collect directly from your own audience on your own properties: site behaviour, purchases, support conversations, and anything customers tell you.
- What is cookie banner?
A cookie banner is the notice that asks a visitor's permission before storing or reading information on their device.
- What is server-side tracking?
Server-side tracking sends analytics events from your own backend rather than from the visitor's browser.
- What is unique visitor?
A unique visitor is one person counted once within a reporting period, no matter how many times they visit or how many pages they view.
Where this shows up in Mrkr
- Read how Mrkr identifies visits without browser storage
The rotating salted hash, in detail, including what it cannot do.
- Privacy configuration in the Mrkr docs
- Browse the full analytics glossary
Every metric, method and privacy term, defined in one place.
Your first visitor is already here.
Drop in the script and watch them land. It takes about a minute.