Cookieless website analytics, explained

“Cookieless analytics” covers a family of tools that count visits without putting an identifier in the visitor’s browser. They trade some depth for simplicity and a lighter footprint. This post explains how the counting works, what you get, what you give up, and how it fits next to Google Analytics 4.

How cookie-based analytics counts visitors

Traditional analytics recognises a returning browser by storing an ID on it. GA4, for example, sets a first-party cookie called _ga that holds a random client ID and, by default, lasts two years. Every visit from that browser carries the same ID, so GA4 can stitch visits together into users, tell new visitors from returning ones, follow someone across days, and credit this week’s purchase to last month’s ad click.

That ID is the source of GA4’s depth, and of its friction. In many places, storing or reading an identifier on someone’s device needs their consent unless it’s strictly necessary for the service they asked for, which is why consent banners exist. Visitors who decline, browsers that limit how long scripts can keep data, and content blockers that stop the script all leave gaps in the numbers.

Counting without cookies: daily-rotating salted hashes

Without a stored ID, a tool needs another way to tell whether two pageviews came from the same visitor. The common approach, and the one Trafficmend uses, is to compute a value on the server from details that arrive with every request anyway, mixed with a secret that changes every day:

visitor_id = sha256(daily_salt + site_id + ip_address + user_agent)

Each ingredient has a job:

• IP address and user agent (the browser’s description of itself) make the same visitor produce the same value from one pageview to the next.
• Site ID gives the same person a different value on every site, so visits can’t be matched across sites.
• Daily salt is a random secret generated fresh each day. Because it changes, the same visitor produces an unrelated value tomorrow, so visits on different days can’t be linked.
• The hash is one-way. You can’t work back from the result to the IP address or user agent.

What happens to old salts is the important detail. If they were kept, anyone with the database could recompute an earlier day’s values from an IP address and user agent. Trafficmend uses one salt per UTC day and deletes earlier days’ salts, so once a day is over, nobody, including us, can recompute or link that day’s visitor IDs. The IP address goes into the calculation and isn’t saved with the visit.

The result: a visitor counts once per day per site, and nothing is stored on their device. The only thing Trafficmend’s script reads in the browser is an optional localStorage flag that site owners can set in their own browser to leave their own visits out. By default it also skips automated browsers that announce themselves as such and pages served from localhost, and a page the browser prerenders in the background only counts if someone actually views it.

What cookieless analytics can measure

Most of the questions people ask day to day don’t need a persistent ID. A cookieless tool can typically report:

• Pageviews and unique visitors per day, and who is on the site right now.
• Top pages, including the pages visits start and end on.
• Sources: referring sites, search engines, AI assistants, social networks, and campaigns tagged with UTM parameters.
• Countries, devices, browsers and operating systems, read from the request.
• Goals and custom events, such as sign-ups or clicks on a button, and revenue when you send it with an event.
• A visitor’s path within a day: which pages they viewed, in what order, and how long they stayed engaged.

For a content site, a product’s marketing site or a shop’s landing pages, that answers the questions asked most often: is traffic up, where is it coming from, which pages work, and what converts.

What it can’t measure

The daily reset that protects visitors also sets the limits:

• New versus returning visitors across days. Tomorrow, everyone is new.
• Unique visitors over a week or a month. You can add up daily visitors, but someone who visits on five days counts five times, so the total overstates weekly reach.
• Journeys and attribution across days. If someone reads a post on Monday and signs up on Thursday, the two visits aren’t linked, so the sign-up is credited to Thursday’s source.
• Cohorts, retention and lifetime value per user.
• Cross-device behaviour, and anything that depends on a signed-in identity across platforms.
• Remarketing audiences for advertising.

Within a day, the count is an approximation too. Two people on the same network using the same browser version can share an IP address and user agent (in an office, say) and count as one. One person whose IP address changes during the day, moving from mobile data to Wi-Fi for example, counts as two. For trends these errors mostly wash out. For exact counts, no web analytics method is exact.

A note on consent

“Cookieless” describes a technique, not a legal status. The rules on analytics differ between jurisdictions. Under some, such as the EU’s ePrivacy rules, what matters is storing or reading information on the device at all, whether or not it’s a cookie. Processing an IP address, even briefly, can also fall under data-protection law such as the GDPR.

A cookieless approach can make compliance simpler, and some data-protection authorities have published guidance on when audience measurement can be exempt from consent. Whether any of that applies to you depends on where you and your visitors are, how the tool is configured, and what you do with the data.

Trade-offs against GA4

Neither column is better in general; they answer different questions. GA4 is built to follow users over time and to feed advertising. A cookieless tool is built to count visits simply and show what’s happening now.

Blocking is worth a mention because it affects both. Many content blockers block Google Analytics. Cookieless scripts can be blocked too, especially when they load from a well-known third-party domain. No client-side tool sees every visit, which is one more reason to compare trends rather than totals.

Why many teams run both

Running both is common, because their strengths barely overlap:

• GA4 for depth: attribution, funnels across visits, cohorts, ecommerce reports, ads integration, and the BigQuery export for analysts.
• Cookieless analytics for the everyday view: today’s traffic, live visitors, top pages and sources, readable by the whole team without someone building an exploration first.
• A cross-check. When GA4 numbers drop suddenly, a second source helps you tell a real change in traffic from a tagging or consent problem.

Don’t expect the numbers to match. The tools define visitors and sessions differently, may count days in different time zones, filter bots differently, and see different groups of visitors depending on consent and blockers. Compare trends between them, not absolute numbers, and pick one source of truth per question: GA4 for campaign attribution, say, and the cookieless tool for daily traffic.

Trafficmend is built around that pairing. Its cookieless tracker shows who is on your site right now, and it connects GA4 and Search Console with read-only access, so live visits, traffic and search sit side by side, with fixes ranked by the clicks they’re expected to bring.