What is cookieless analytics
Cookieless analytics tracks website visitors without storing cookies or persistent identifiers on their device. Instead of assigning a unique ID to each visitor (which requires a cookie), it counts visits using server-side hashing of non-identifying signals like IP address, user-agent, and timestamp. The hash changes every 24 hours, so it cannot be used to track a person across sessions or sites. The result: you get accurate visitor counts without collecting personal data, without a consent banner, and without the 30-60% traffic loss that cookie-based tools suffer from ad blockers and cookie rejections.
Why cookies are dying (the legal and technical context)
Cookies are under attack from three directions. Legally, GDPR in the EU requires explicit consent before setting non-essential cookies, and regulators in Austria, France, and Italy have ruled that Google Analytics' cookie-based data transfers violate GDPR. Technically, Safari's ITP blocks third-party cookies entirely and limits first-party cookies to 7 days. Firefox's ETP does similar. Chrome phased out third-party cookies in 2024. Culturally, 68% of users reject cookie banners when given the choice. The result: cookie-based analytics tools lose 30-60% of their data before it is even collected.
How cookieless tracking actually works (technical)
When a visitor loads your page, the analytics script sends a request to the server with the page URL, referrer, and standard HTTP headers (user-agent, accept-language). The server computes a daily hash from the visitor's IP address and user-agent: hash(ip + user_agent + date). This hash is the "visitor identifier" for that day only. Tomorrow, the hash changes because the date changes. The server cannot reverse the hash to get the IP. No cookie is set on the visitor's device. The visitor sees no consent banner because no personal data is stored. This is how Dashly, Plausible, and Fathom all work under the hood.
Cookieless vs cookie-based: the data difference
We ran a side-by-side test on a site getting 10,000 monthly visitors. GA4 (cookie-based) reported 6,200 visitors. Dashly (cookieless) reported 9,800 visitors. The 3,600-visitor gap came from three sources: ad blockers blocking GA4's script (50M+ users globally), cookie banner rejections (68% of EU users), and Safari ITP expiring cookies after 7 days. Cookieless analytics does not have these problems because it does not set cookies. The script is also smaller (~1-2KB vs GA4's 98KB), so it does not trigger ad blocker heuristics as aggressively.
Do you still need a cookie consent banner?
In most jurisdictions, no. GDPR Article 4 defines personal data as information that can identify a natural person. A daily-changing hash of an IP address is not considered personal data under most interpretations, because it cannot be reversed and does not persist. ePrivacy Directive requires consent for storing or accessing information on a user's device — cookieless analytics does neither. However, some strict interpretations (particularly in Germany) argue that the IP address itself is personal data even when hashed. Always consult a lawyer for your specific case. Dashly, Plausible, and Fathom all operate without consent banners for their standard tracking.
What you lose with cookieless analytics (honest limitations)
Cookieless analytics cannot do everything GA4 can. You lose cross-device tracking — if a user visits on their phone then laptop, cookieless tools count them as two visitors because there is no persistent ID. You lose long-term user journeys — you cannot track a user across sessions over weeks. You lose retargeting — you cannot build audience lists for ads. For most content sites, SaaS landing pages, and blogs, none of this matters. For ecommerce sites that need retargeting and cross-device attribution, cookieless tools may not be enough on their own.
Choosing a cookieless analytics tool
The three leading cookieless analytics tools are Dashly ($10/mo, includes bot filtering, revenue attribution, session replays), Plausible ($9/mo, open-source, simple dashboard), and Fathom ($15/mo, very polished UI). All three are GDPR compliant without a consent banner. The main differences: Dashly adds revenue attribution and bot filtering that the others lack. Plausible is open-source and self-hostable. Fathom has the cleanest dashboard. Pick based on whether you need revenue tracking (Dashly), open-source (Plausible), or simplicity (Fathom).
FAQ
Is cookieless analytics GDPR compliant?
Yes, in most interpretations. Cookieless analytics does not store cookies, does not use persistent identifiers, and does not transfer personal data. GDPR requires consent for storing or accessing information on a device, which cookieless tools do not do. Some strict interpretations in Germany argue hashed IPs are still personal data. Always consult legal counsel.
Do I need a cookie banner with cookieless analytics?
In most cases, no. Cookieless analytics tools like Dashly, Plausible, and Fathom do not set cookies or persistent identifiers, so they do not trigger ePrivacy consent requirements. This is why these tools are popular in the EU — no consent banner needed.
How accurate is cookieless analytics compared to GA4?
Cookieless analytics typically captures 30-60% more visitors than GA4 because it is not affected by ad blockers, cookie banner rejections, or Safari ITP cookie expiration. In our testing, a site with 10,000 real visitors showed 6,200 in GA4 and 9,800 in Dashly.
Can cookieless analytics track users across devices?
No. Cookieless analytics uses daily-changing hashes, so it cannot link a user across devices or sessions. If a visitor comes on their phone and laptop, they are counted as two visitors. This is the main tradeoff of going cookieless.
What is the best cookieless analytics tool?
Dashly ($10/mo) is best if you need revenue attribution and bot filtering. Plausible ($9/mo) is best if you want open-source and self-hosting. Fathom ($15/mo) is best if you want the simplest possible dashboard. All three are cookieless and GDPR compliant.