How we count visitors without cookies
A plain, honest look at how sonex counts unique visitors with no cookie and no stored identifier, using a rotating daily hash that cannot be reversed or linked across days.
All posts
Counting unique visitors normally means storing a cookie so the same browser is recognised on its next visit. That stored identifier is exactly what turns a pageview into personal data. sonex counts uniques without it. Here is how, in plain terms.
The problem with the cookie
A cookie is a durable label written to the visitor’s device. It is useful precisely because it persists, which is also what makes it personal data under the GDPR and triggers the ePrivacy consent requirement. If we want no consent banner, we cannot keep a durable label. So we do not.
A hash instead of an identifier
When a pageview arrives, sonex builds a short anonymous fingerprint from coarse, non-identifying request signals, then combines them with a secret salt and runs the result through a one-way hash.
visitor_hash = hash(daily_salt + website_id + coarse_signals)Two properties make this safe:
- One-way. A hash cannot be reversed. Given the output, there is no way back to the inputs, so the value never identifies a person.
- Salted per day. The
daily_saltis a secret that rotates every 24 hours. Today’s hashes and yesterday’s are computed from different salts, so they cannot be matched.
Why it resets, on purpose
Because the salt rotates daily, sonex cannot link a visitor from one day to the next. That sounds like a limitation, and for surveillance it is. For honest analytics it is the point: the system is built to forget. You get an accurate daily unique count without the ability, or the temptation, to follow one person over time.
What you can and cannot measure
You can measure daily and range visitor counts, new versus returning within a day, pages, referrers, funnels and coarse geography. You cannot build a permanent per-person profile, follow one individual across weeks with certainty, or power cross-site advertising audiences. That trade is deliberate.
Why we are telling you this
Privacy claims are only worth as much as their mechanism. Plenty of tools say “anonymous” while quietly keeping a durable identifier. We would rather show the method: a one-way hash, a salt that rotates daily, and raw inputs that are never stored. If a tool cannot explain how it protects you, that is the answer.
That mechanism is what lets sonex count your traffic accurately while collecting no personal data and asking your visitors for nothing.
Frequently asked questions
- How do you count unique visitors without a cookie?
- sonex derives a short-lived, anonymous fingerprint from coarse request signals combined with a secret salt that rotates every day. The value is a one-way hash, so it cannot be reversed to a person, and because the salt changes daily it cannot link a visitor across days.
- Does counting without cookies store my IP address?
- No. The IP address is used only as an input to the daily one-way hash and is never stored. What is kept is an anonymous count, not a record of who visited.
- Why does the visitor count reset each day?
- By design. The salt rotates every 24 hours, so yesterday's anonymous hashes cannot be matched to today's. That deliberate forgetting is what keeps the method free of personal data and consent requirements.
sonex is privacy-first web analytics. No cookies, no consent banner, no personal data. Drop one script and read realtime visitors, funnels and a world map in seconds.
Try sonex free