Cookieless web analytics tools

What “cookieless” means here

We mark a tool as cookieless when, in its default setup, its tracking script sets no cookies and stores no identifier anywhere else in the browser that outlasts the current tab, such as in local storage. The value comes from the vendor’s documentation and privacy information. It describes the default only: settings and add-ons you switch on later can change it.

How these tools count visitors. Without an identifier in the browser, a tool has to recognize a returning visitor in another way, or not at all. Several tools create a hash from data that arrives with each request, such as the IP address and browser details, combined with a secret value (a salt) that the vendor replaces on a schedule, for example every day. A visitor who comes back after the salt has changed is counted as new. This is one reason why unique visitor numbers from different tools are not directly comparable.

Cookieless is not the same as “no consent banner”. A cookie is only one way to store or read information on a visitor’s device. In the EU, the ePrivacy rules generally require consent for storing or reading such information, with some exceptions. The European Data Protection Board’s guidelines state that these rules apply to “similar technologies” as well as cookies, and that whether consent is needed has to be assessed case by case; national rules also differ in the detail. Data protection law applies separately to personal data, and an IP address can be personal data. The server that receives a tracking request sees the visitor’s IP address, even if the tool never stores it. Outside the EU, other rules apply.

Whether your site needs a banner therefore depends on:

• the rules in the places where you operate and where your visitors are;
• everything else your pages load, such as advertising pixels or videos embedded from other services;
• how you configure the tool: identifying signed-in users, sending personal data in event properties or switching on features that store data in the browser can change the answer.

Some vendors state that their tool needs no consent banner. Tool cards show such statements as the vendor’s position, and this page is not legal advice.

Four tools sit outside this page for a reason worth naming. Pretty Insights, TinyAnalytics, Databuddy and Rybbit set no cookies, and each of their scripts still writes an identifier into the browser’s local storage, where it survives the tab and the session until something clears it. The check looks at what the script stores, not at the words on a vendor’s site, so the column says No for all four. The page on privacy-friendly tools sets out what each one keeps.

What “Partly” means. This page lists only tools that are cookieless by default. In the full table, “Partly” in the Cookieless column marks tools that offer a cookieless mode that is not on by default. You have to switch it on in the settings or in the tracking code; check the vendor’s documentation for what changes when you do.

What the column does not cover. It says nothing about where the data is stored, how long it is kept or whether IP addresses are saved. The Data in EU column covers the location. For retention and the handling of IP addresses, read the vendor’s privacy policy.

Questions and answers

How does cookieless tracking work?

The tracking script sends a request to the analytics server for each pageview or event without writing an identifier into the browser. The server records the page, the referrer and technical details such as the browser type, and can derive an approximate location from the IP address. To count unique visitors, several tools hash the IP address and browser details together with a salt that changes on a schedule, so a visitor can be recognized only for a limited time; other tools use other methods.

Do I still need a consent banner with a cookieless tool?

It depends on your jurisdiction, on everything else your site loads and on how you configure the tool. In the EU, consent rules are not limited to cookies, and data protection law can apply to IP addresses. If a vendor says its tool needs no banner, treat that as the vendor’s position and check it against the rules that apply to you, with legal advice where needed. This directory does not give legal advice.

Does cookieless mean that no personal data is processed?

Not necessarily. The server that receives a tracking request sees the visitor’s IP address, whether or not the tool stores it; some vendors state that they use it only to calculate a hash and never save it. You can also send personal data yourself, for example in event properties or in page addresses that contain an email address. Tool cards show “No personal data collected” as the vendor’s position, not as a finding of this directory.

Are numbers from cookieless and cookie-based tools comparable?

Only with care. A cookie-based tool can recognize a returning browser for as long as its cookie lasts, while a hash-based tool recognizes it only until the salt changes, so unique visitor counts can differ for the same traffic. If a cookie-based tool runs only after a visitor agrees, visitors who decline are not counted at all. Blocking by browser extensions and bot filtering also vary from tool to tool. Compare trends within one tool rather than totals across tools.