Cookieless analytics explained: how to count visitors without cookies

September 25, 2026 · 5 min read

Traditional analytics drops a cookie with a random ID in each visitor's browser and reads it on every visit. It works, but it comes with a consent banner, lost data from people who click “reject”, and a lot of personal data sitting in someone else's database. Cookieless analytics takes a different approach.

The daily-salt technique

Instead of storing an ID on the device, the server computes one for each request:

visitor_id = hash(daily_random_salt + site + ip_address + user_agent)

• The same person on the same device produces the same ID all day, so unique visitors and sessions can be counted.
• The salt changes every 24 hours and the old one is deleted. Yesterday's IDs can't be recomputed, and today's can't be linked to yesterday's.
• The IP address is used only for that calculation and never stored.

What you can still measure

Almost everything a growing business actually uses: visitors, pageviews, bounce rate, time on site, sources and campaigns, countries, devices, entry and exit pages, funnels, goals, and revenue attribution within a visit.

What you give up

• Long-term returning-visitor tracking. Someone who visits on Monday and Thursday counts as two visitors. For most decisions, that's fine.
• Cross-device stitching. Phone and laptop are separate visitors. Cookie-based tools mostly can't do this reliably either without logins.
• Ad retargeting audiences. That's the point: this data isn't built to follow people around.

Do you still need a consent banner?

Consent rules are mainly about storing or reading information on the user's device and about processing personal data. A tool that sets no cookies and stores no personal data is designed so that, in most cases, no banner is needed for analytics. Laws and interpretations vary by country, so check with your own legal counsel for your situation.

The practical upside

No banner means fewer visitors bouncing on a pop-up, and no “reject” clicks silently removing a chunk of your data. The script can also be tiny: Cleverpilot's is about 1KB gzipped. For most startups, that trade is well worth it. Try it free or read exactly what we collect.