The problem to solve
Analytics needs to answer "how many different people visited", and the traditional solution is to give each browser an identifier and store it. Remove the storage and you need another way to distinguish two visits by the same person from two visits by different people.
How it is usually done
A cookieless tool computes a hash from signals available in the request itself — typically a combination of the IP address, the user agent string, and the site's own identifier — mixed with a salt that rotates, usually daily.
Three properties follow from that design:
- Nothing is written to the device. No cookie, no localStorage entry.
- The hash cannot be reversed to recover the IP address.
- When the salt rotates, the link is broken. Yesterday's hash and today's hash for the same visitor are unrelated, by construction, so no cross-day profile can exist even in principle.
The IP address is used in memory and discarded. It is never stored.
What that means for the numbers
Within a day, the count of unique visitors is a good approximation. Two people behind the same corporate NAT with identical devices may merge into one; one person switching from wifi to mobile data may count as two. In aggregate these errors are small and, more importantly, stable — which is what matters for tracking trends.
Across days, there is no concept of a returning visitor. A person visiting on Monday and Thursday counts as one visitor on Monday and one on Thursday.
What survives intact
- Page views and their trend
- Daily unique visitors
- Traffic sources and referrers
- Entry pages, exit pages, and the ranking of top content
- Country, device type, browser
- Conversions within a session
- Campaign performance via UTM parameters
What genuinely breaks
- Returning visitor rate and loyalty metrics
- Multi-session funnels — someone who researches for a week before buying
- Cross-device journeys, which most cookie-based tools handled poorly anyway
- Cohort retention over weeks
If your product decisions depend on multi-week individual journeys, cookieless web analytics is the wrong tool and you want a product analytics platform with authenticated user identity — where the user has an account and identity is not a tracking question at all.
The compliance consequence
Because nothing is stored on the device and no persistent identifier for an individual exists, the storage-and-access rule that drives the cookie banner generally does not bite. That is the practical reason cookieless analytics is attractive in Europe: it removes a requirement rather than managing it.
There is a second-order benefit that people underrate. Without a consent banner, no visitors are excluded from the dataset by declining, and a first-party lightweight script is blocked far less often than a well-known advertising endpoint. The result is usually more complete data, from a tool that collects less.
The honest summary
Cookieless analytics gives you accurate aggregate truth and no individual-level history. For most websites that is precisely the right trade, because most decisions were always made on aggregates. Be sure it is the right trade for you before switching, rather than after.