What is Cookieless analytics?
Cookieless analytics measures website traffic without setting cookies or writing to any device storage. Because the ePrivacy consent requirement is triggered by storing or reading data on a device, a tool that stores nothing does not trigger it. Visitors are recognised for a limited window using a derived, rotating identifier instead.
How a visitor is recognised without storage
If nothing can be stored, identity has to be derived from the request itself. The usual construction:
- Take stable request attributes — the website id, the IP address, the user agent, the screen size, the language.
- Hash them together with a secret salt that rotates on a schedule, typically daily.
- Use the resulting value as the visitor identifier for that window.
When the salt rotates, the old identifiers cannot be reproduced. Yesterday’s visitor and today’s cannot be linked, even by the people running the system.
sonex works this way, with one refinement: a visit already in progress when the salt rotates would otherwise split into two visitors, so the previous salt is briefly consulted to stitch that single visit back together. The window is short and deliberate.
What you give up, stated plainly
Honest cookieless analytics is worse at exactly one thing: identity over long periods.
- Returning visitors across days are counted as new.
- Multi-week attribution journeys cannot be reconstructed.
- Long-horizon retention on anonymous traffic is not available.
Everything else is unaffected — traffic, pages, referrers, campaigns, funnels within a visit, geography, and revenue read from a payment provider. For most sites the trade is: give up the ability to follow individuals for months, keep every number you actually use.
Not the same as “cookieless” in advertising
The advertising industry uses the same word for a different project: replacing third-party cookies with other cross-site identifiers — hashed emails, identity graphs, fingerprinting. Those still identify people; they simply do it without a cookie.
Worth checking which meaning a vendor intends. “No cookies” and “does not identify your visitors” are very different promises.