Cookieless analytics explained: how to count visitors without cookies

For two decades, website analytics meant cookies. A script dropped an identifier into the visitor's browser, read it back on every page, and stitched those pages into a profile that could follow the person for months. It worked, but it came with consent banners, blocked scripts, and a growing pile of privacy law.

Cookieless analytics answers a narrower question: how many people visited, where did they come from, and what did they read? It turns out you don't need to identify anyone to answer that well.

What a cookieless tracker actually collects

When a page loads, a small script sends one request with the information the browser already shares with every website it visits:

• The page URL and the referrer (the page that linked to you).
• The browser, operating system and screen width, read from the user agent and viewport.
• The country and city, looked up from the IP address on the server and then discarded.
• UTM parameters, if the link had them, so campaigns are attributed correctly.

Nothing is written to the visitor's device. There is no cookie, no localStorage entry and no fingerprint built from fonts, canvas rendering or installed plugins.

Counting unique visitors with a daily rotating hash

Without a cookie, how do you know two pageviews came from the same person? The common technique, used by StaTrak and other privacy-first tools, is a salted hash that changes every day:

visitor_id = hash(daily_salt + website_domain + ip_address + user_agent)

1. A random salt is generated every 24 hours and kept only in memory.
2. Each request is hashed with that salt, the site's domain, the IP address and the user agent.
3. Only the resulting hash is stored. The IP address itself is never written to disk.
4. When the day ends, the salt is deleted. Yesterday's hashes can no longer be recreated or linked to today's.

Because the website domain is part of the input, the same person gets a different hash on every site, so nobody can be followed from one site to another. Because the salt rotates, nobody can be followed from one day to the next either.

What you give up, and why it rarely matters

A daily hash means a visitor who returns tomorrow counts as a new unique visitor. For most sites, the question that matters is "how many people did we reach this week and where from?", not "is this the same individual we saw in March?" Session-level metrics like bounce rate, pages per visit and visit duration still work, because a session happens within a single day.

How to get started

Switching is usually a one-line change. Add your website to StaTrak, paste the script tag into your site's <head>, and remove the old tracking tag and the consent prompts that existed only because of it. Data starts flowing on the next pageview.