What is cookieless web analytics?

What changes without cookies

Classic analytics stores a random ID in a cookie the first time someone visits, then reads it on every later visit. That makes returning visitors easy to count, but storing or reading an identifier on a device is exactly what cookie and e-privacy rules regulate, which is why so many sites show a banner.

A cookieless tool stores nothing in the browser. It counts pageviews, events and sessions normally, and estimates visitors on the server, typically by hashing the IP address and browser with a secret salt. The page can load with no banner for the analytics script itself, and visitors who decline cookies are still counted in aggregate.

The trade-offs

• Returning visitors are approximate. A visitor who changes network or device looks new. A visitor behind a shared office or mobile carrier address can be merged with others.
• No long-term individual history unless people sign in and you choose to identify them.
• More complete aggregate data. Banner refusals often remove a large share of visits from cookie-based tools; cookieless counting keeps them.

For most marketing and content questions — which pages work, which channels bring traffic, where people drop — aggregate counts are what matter, and cookieless data is often more complete.

Does cookieless mean no consent?

Not automatically. Avoiding cookies removes the device-storage question, but data protection law still applies to the processing itself, especially of IP addresses. Some regulators, such as France's CNIL, describe conditions under which audience measurement can be exempt from consent — limited purpose, no cross-site tracking, truncated IPs, limited retention. Whether you need consent depends on your configuration and your jurisdiction; check with your legal adviser.

Cookieless analytics in TapCub

TapCub's web script writes no cookies and no local storage by default. The server computes a visitor ID from a secret site salt, the site, the IP address (first 64 bits for IPv6) and the browser and operating system without version numbers, and never stores the IP itself. In the default balanced mode the salt is kept, so the same browser on the same network is recognised on later days; in strict mode it rotates daily.

The compliance centre sets the collection tier per site — anonymous aggregate, cookieless pseudonymous, or first-party cookie with sign-in identity — and has a CNIL exemption preset that applies cookieless counting, no consent prompt, IP truncation and retention of at most 25 months, and locks those fields.

For how cookieless and cookie-based counts differ in accuracy, and how to measure the gap on your own site, see cookieless vs cookie-based analytics.

Related guides: GDPR-Compliant Analytics and Website Visitor Tracking.