What is cookieless tracking?
Cookieless tracking is any method of recognising visits without storing an identifier in the browser. The main approaches are rotating salted hashes of request signals, server-side session identifiers, authenticated user ids you supply yourself, and device fingerprinting. Only some of them avoid a consent requirement, and fingerprinting does not.
Worked example
The same visitor, four methods, one week.
| Daily rotating hash | 7 different identifiers, one per day |
|---|---|
| Server-side session id in a first-party cookie | 1 identifier, and a consent requirement |
| Your own user id after login | 1 identifier, accurate, no browser dependency |
| Device fingerprint | 1 identifier, persistent, and consent is required in the EU |
Only the first method both avoids storage and avoids persistence Cookieless is not one technique. Two of these are privacy-preserving, one is an account relationship, and one is tracking by another name.
Compared
The four methods They are grouped under one label and they behave very differently. The column that decides most architecture debates is the last one.
| Method | How identity is derived | Cross-day | Consent needed in EU |
|---|---|---|---|
| Rotating salted hash | Hash of IP, user agent and domain with a secret salt regenerated daily | No, by design | Generally not, since nothing is stored |
| Server-side session id | Issued by your server, usually in a first-party cookie | Yes | It is still storage on the device |
| Authenticated user id | Your own account id, sent with events | Yes | Covered by your account terms, not ePrivacy |
| Device fingerprinting | Canvas, fonts, hardware and dozens of other signals combined | And it survives clearing data | And regulators treat it as equivalent to a cookie |
The ePrivacy rules govern storing or accessing information on terminal equipment. Fingerprinting is explicitly in scope for reading device information, which is why calling it cookieless does not make it consent-free.
Why the industry moved
Third-party cookies were the foundation of cross-site advertising measurement, and they have been removed or restricted almost everywhere. Safari blocks them and caps script-set first-party cookie lifetimes to seven days. Firefox isolates them by site. Chrome now surfaces a user choice.
First-party analytics cookies survive but are less durable than teams assume: an ITP-capped cookie means a visitor returning after eight days is counted as new, which quietly inflates unique visitor counts and truncates attribution windows.
At the same time consent enforcement tightened, and refusal rates on properly implemented banners are high. A tool that only measures consenting visitors is measuring a biased sample of your traffic.
Cookieless methods sidestep both problems by not depending on browser storage at all. What they cannot do is manufacture cross-day identity out of nothing, and any vendor claiming to have solved that without storage is describing fingerprinting.
Live demo
See it on real data. The live demo is a fully populated dashboard on demo traffic, with no signup and no card.
Open the live demoWhat to check before believing a cookieless claim
Does it write anything durable to the device?
Open the browser devtools, load the page and inspect cookies, localStorage, sessionStorage and IndexedDB. Cookies, localStorage and IndexedDB should be empty. A per-tab sessionStorage key that the browser destroys when the tab closes is normal and is what most cookieless tools use to stitch a single visit together: mrkr writes one. What matters is that nothing survives the tab, because persistence across visits is what turns an identifier into a tracking identifier.
How long does the identifier live?
A rotation period of 24 hours is the common standard. Anything longer, or an identifier that survives a browser restart, is closer to fingerprinting than to hashing.
Is the salt secret and rotated?
Without a secret salt, a hash of IP and user agent is trivially reversible by anyone who can guess the inputs. The salt is what makes it one-way in practice.
How many signals does it collect?
Two or three coarse signals is hashing. Canvas rendering, installed fonts, audio context and screen metrics is fingerprinting, whatever the marketing page calls it.
How mrkr does it
mrkr's default is the first method: a hash of IP address, user agent and site domain combined with a secret salt that rotates daily. The raw IP is never stored, nothing is written to the browser, and the identifier stops working after 24 hours.
For sites that genuinely need cross-session identity there is an optional cookie mode, enabled per site. It gives you long attribution windows and multi-day visitor recognition, and it does require a consent banner on that site. mrkr does not fingerprint in either mode.
For logged-in products, sending your own user id with events is usually better than either option: it is accurate, it survives device changes, and it rests on a relationship the visitor already agreed to.
FAQ
Is cookieless tracking legal without consent?
A method that stores nothing on the device and cannot identify a person, such as a daily-rotating salted hash, is generally run without consent in the EU and UK. Fingerprinting is not, because reading device information is in scope for ePrivacy regardless of whether a cookie is involved.
Is cookieless tracking accurate?
Within a day it is often more accurate than cookie-based tracking, since there is no banner to decline and no cookie for the browser to expire. Across days it is not accurate at all by design, because the identifier is rotated so that nobody can be followed.
Is fingerprinting a form of cookieless tracking?
Technically it stores nothing, so vendors describe it that way. Regulators do not accept the distinction: fingerprinting reads information from the device and is treated the same as a cookie under ePrivacy, and it is designed for exactly the persistence that privacy-preserving methods deliberately avoid.
Start with one line of HTML.Your first visitors show up within a minute.