Cookieless Tracking: How It Works and What It Misses

Cookieless tracking is any way of measuring visits to a website without setting a cookie in the visitor’s browser. Instead of a long-lived cookie identifier, a cookieless tool counts visitors with a short-lived hash, a random id kept in browser storage, or server-side data alone, and usually stores no personal data at all.

Two changes pushed site owners toward it: Safari and Firefox block third-party cookies by default, and consent banners left analytics with data only from visitors who clicked accept. This guide covers how cookieless tracking works, what it can and can’t tell you, and where the law still applies. It is not legal advice. A note on bias: we make Indiehacker Studio, a cookieless analytics tool, and we say so where it comes up.

How does cookieless tracking work?

An analytics tool has to answer one question: is this the same visitor as a minute ago? Cookie-based tools answer it with an identifier stored in a cookie. Cookieless tools use one of three other methods.

Method	How it identifies a visitor	Stored on the device	Lasts
Daily hash	Hash of IP, user agent, site and a salt that changes daily	Nothing	One day
Random id in browser storage	A random string in localStorage, not tied to a person	A random id	Until the visitor clears it
Server-side only	Requests in server logs, no script	Nothing	Per request

Daily hash. The server combines the visitor’s IP address, user agent, the site and a secret salt, then hashes the result. The same browser produces the same hash for the rest of the day. Tomorrow the salt changes, so yesterday’s visitor can’t be linked to today’s. Plausible, for example, documents this approach in its data policy.

Random id in browser storage. The script creates a random string the first time a browser visits and keeps it in localStorage. It goes only to the analytics server of that site and isn’t linked to a name, an email or an IP address. Indiehacker Studio uses this method, because it also keeps a visitor’s support chat attached to the right browser. Since it’s stored on the device, it falls under the same ePrivacy rule as a cookie, covered below.

Server-side only. Some tools read your web server’s logs and need no browser script. They see every request, including bots, and can’t see what happens inside a single-page app.

Is cookieless tracking the same as fingerprinting?

No, and the difference matters. Fingerprinting combines many browser traits, such as fonts, canvas rendering, screen and plugins, to build an identifier that follows a person across sites and sessions without their knowledge. European regulators count it under the same ePrivacy rule as cookies: the EDPB’s Guidelines 2/2023 (final version adopted October 2024) on the technical scope of Article 5(3) cover techniques that read information from a device, not only cookies.

Privacy-minded cookieless tools do the opposite: they collect as little as possible, scope any identifier to one site, and make it short-lived or easy to clear. When you evaluate a tool, look for those three properties rather than the word “cookieless” on the landing page.

Does cookieless tracking avoid GDPR and the cookie banner?

Not automatically. Two different rules apply in the EU:

• The ePrivacy rule (Article 5(3) of the ePrivacy Directive) covers storing or reading information on a visitor’s device, not only cookies. A random id in localStorage falls under the same rule as a cookie. Some regulators allow analytics without consent under conditions: France’s CNIL, for example, exempts audience measurement trackers that are limited to one publisher, used only for statistics, not combined with other data, and kept for a limited time.
• GDPR applies whenever you process personal data. An IP address can be personal data. A tool that does not store IPs or link visits to a person reduces what GDPR covers, but you still need to describe it in your privacy policy.

A daily hash stores nothing on the device, which is why tools using it often say no banner is needed. Tools using browser storage rely on exemptions like the CNIL’s. This isn’t legal advice: rules vary by country, so check the guidance that applies to you. For the specific case of Google’s tool, see Google Analytics and GDPR.

What do you lose with cookieless tracking?

Some things, depending on the method.

• Returning visitors over long periods. With a daily hash, every day starts fresh. With a random id, clearing storage or switching devices resets it.
• Cross-device journeys. Visitors are not followed from phone to laptop. Your own signup data already knows who your users are.
• Ad attribution across many visits. You keep the referrer and UTM tags for the visit that arrived, not a history of every ad a person saw.

In exchange you may gain data: a tool that runs without a consent banner also counts the visitors who would have declined one, while a banner-gated tool counts only the people who click accept. We go deeper into this trade in cookieless analytics without a cookie banner.

How do you switch to cookieless tracking?

1. List what you actually read in your current analytics. For most small sites, it’s visitors, sources, top pages and one conversion.
2. Pick a cookieless tool that covers that list. Our free website analytics roundup compares several.
3. Run it next to your old tool for two weeks and compare trends, not exact numbers.
4. Tag your own links with UTM parameters so campaigns stay visible. See website visitor tracking.
5. Remove the old script and update your privacy policy.

FAQ

Is cookieless tracking accurate?

For trends, yes. Unique visitor counts are approximate in any tool, cookie-based ones included, because of ad blockers, private windows and cleared browsers.

Can cookieless tracking count unique visitors?

Yes, within its window. A daily hash counts unique visitors per day. A random id in browser storage counts them across days until the visitor clears it.

Does Google Analytics have a cookieless mode?

Google’s consent mode can send cookieless pings when a visitor declines cookies, and Google models the missing data. That’s different from a tool designed to work without cookies from the start.

Is localStorage better than cookies for privacy?

Not legally: in the EU both count as storing information on the device. What matters for privacy is what the identifier is linked to, how long it lives and whether it leaves your site.

Measure without cookies

Indiehacker Studio tracks visits with no cookies, a random id per site in browser storage and no stored IP addresses. The same script adds chat, feedback and bug reports. Read how we handle data on the privacy section, then start free with one project.