"Cookieless" is doing a lot of work in that sentence

Every analytics vendor is cookieless now, the way every cereal is natural. The word only tells you what a tool doesn't use — it says nothing about whether visitors are actually anonymous. Under the label live several very different designs, and at least one of them is tracking with better marketing. Here's how to tell them apart.

Technique 1: count events, recognise nobody

The simplest honest design: log each pageview with no identifier at all. Perfectly private, but it can't tell 100 pageviews from 100 visitors, can't compute bounce rates, and can't show entry pages. Some minimal tools live here happily; most sites find the numbers too thin to act on.

Technique 2: the rotating-salt hash (the common honest compromise)

Most reputable cookieless tools do a version of this: on each hit, combine the visitor's IP and user-agent with a secret random salt, hash the lot, and store only the hash. The raw IP is never written anywhere. Crucially, the salt is destroyed and regenerated on a schedule — typically every 24 hours — so today's hashes are mathematically unlinkable to tomorrow's, even for the vendor, even for someone who steals the database. Within one day you get real uniques, sessions, bounce rates and entry/exit pages; across days, recognition is impossible by construction, not by policy.

The honest cost: "weekly visitors" from such a tool is really a sum of daily uniques, which overcounts people who return on different days. A vendor doing this properly will tell you so on the report page rather than presenting a rounder-looking number it cannot actually know.

Technique 3: fingerprinting (the one wearing a disguise)

Take enough signals — screen size, fonts, GPU quirks, timezone, plus IP — and you can recognise a device for weeks without storing anything on it. It's cookieless in the literal sense and more invasive than the cookie it replaced: a visitor can clear cookies, but they can't clear their own graphics card. Regulators treat fingerprinting for tracking exactly as they treat cookies. If a "cookieless" tool offers returning-visitor rates or cross-day journeys, this — or an ID quietly held server-side against the IP — is how, and the label is doing the disguising.

Technique 4: server logs

Your web server already records requests; log analysis needs no script at all. Workable for rough traffic shapes, but raw logs store full IPs (a bigger data-protection question than the one you started with), count every bot that doesn't announce itself, and see caches and CDNs poorly. Usually the numbers are noisier than people expect.

Five questions that sort the honest from the relabelled

Is the raw IP ever written to disk? The honest answer is "no — hashed transiently, then discarded". "We store it briefly" or "we truncate it" are different, weaker designs; ask what "briefly" means.
Can you, the vendor, link my visitor across two days? The right answer is "no, and here's the mechanism that makes it impossible" — salt destruction, not a policy promise. Policies change; destroyed keys don't.
Do you offer returning-visitor or cross-day journey metrics? If yes, something is recognising people across days. That's not automatically evil, but it's not anonymous, and the tool should stop using the word.
What happens when a browser sends DNT or Global Privacy Control? "We honour it" should mean the visitor is never recorded — ideally never even pinged — not "we note their objection".
Where's the write-up? A vendor whose design survives scrutiny publishes it. Vague privacy pages and specific privacy engineering rarely go together.

Our answers, on the record: Ethical Analytics is technique 2 with the caveats printed — daily-destroyed salt, no raw IPs ever written, no fingerprinting, DNT/GPC honoured at script and server, and the "sum of daily uniques" honesty stated on the report itself. The full design is in the docs; a free account covers two sites. We're obviously not neutral about our own product — that's why the docs show the workings instead of asking you to trust us.

Wondering what any of this means for consent banners? Do you need a cookie banner just for analytics? covers the UK rules in plain English. Comparing vendors? Google Analytics alternatives, compared honestly. CAAC, August 2026.

Privacy · Terms · Docs · CAAC