Privacy and compliance
How counting visitors without a cookie actually works, what the different approaches can and cannot promise, and which tools do it properly.
Cookieless analytics has become a marketing label attached to things that work in very different ways, which makes the category hard to shop in. Three vendors can all claim it while one stores a hashed IP address for a year, one rotates an identifier daily, and one stores nothing that could identify a visitor at all.
Those are not the same promise and they do not carry the same compliance consequences. This page sets out the mechanisms, because once you understand them the vendor claims sort themselves out quickly.
A cookie exists to answer one question: is this the same browser I saw earlier? Everything analytics does with returning visitors, sessions, attribution windows and bounce rates depends on being able to answer it.
Remove the cookie and you need some other way to recognise a repeat request, or you need to accept that you cannot. What separates cookieless tools from one another is exactly which of those two paths they take, and how honest they are about it.
The strongest approach in common use works like this. When a request arrives, the server combines the visitor's IP address, the user agent and a secret salt, and hashes the lot into an opaque token. The IP and user agent are then discarded, in memory, before the response is sent. They never reach a log, a database or an object store.
The salt rotates every day and the previous day's is destroyed. That is the load-bearing part. It means today's token cannot be recomputed from yesterday's data, so a visitor seen on Monday cannot be matched to the same visitor on Tuesday. Within a day you get accurate unique visitor counts; across days you get nothing, by construction.
This is what lets a vendor say cross-day tracking is impossible rather than merely switched off. A policy can change. Arithmetic cannot. Absolutely Analytics, Plausible and Fathom all work on this principle, and it is the standard to hold any cookieless claim against.
Some tools store a hashed IP address without rotating the salt, which means the hash is stable and therefore is an identifier, whatever it is called. Some anonymise only the last octet of an IPv4 address, which reduces precision without removing identifiability, particularly on IPv6.
Others use a cookieless mode that is a configuration option rather than a property of the design. Matomo and Clicky both offer one and both work, but a mode you have to switch on is a mode somebody can switch off, and in Clicky's case switching it on removes the per-visitor tracking that is the main reason people buy it.
The question to ask a vendor is simple and it usually settles things: can you recompute last week's identifiers from what you still hold? If the answer is anything other than a flat no, you are not buying the strong version.
You lose returning-visitor analysis across days, cross-device identity, and long attribution windows. If your business genuinely depends on knowing that the person who read a blog post in March converted in June, cookieless analytics cannot tell you that and no vendor should pretend otherwise.
What you gain is that you count everybody. No consent prompt means no declined visitors missing from the data, and a small first-party script is blocked far less often than a recognised advertising tag. For most content and marketing sites that trade is strongly favourable, because the daily numbers are more complete and the cross-day question was never actually being answered well anyway.
For analytics purposes, on the strong implementations, yes. GDPR consent obligations attach to storing or accessing information on a visitor's device, and to processing personal data. A tool that writes nothing to the device and retains no identifier does neither.
Two caveats worth stating. This applies to the analytics tool only: if anything else on your site sets cookies, you still need the banner for that. And this is a lay reading of how these tools work rather than legal advice, so if compliance is material to your organisation, take proper advice using the vendor's technical documentation as the input.
| Tool | From | Free tier | Cookies | Score |
|---|---|---|---|---|
| Absolutely Analytics | $9 per month | No free tier. A 30-day trial of the exact tier you picked | None, so no consent banner | 8.9 |
| Plausible Analytics | £9 per month | No, but the community edition is free to self-host | None, so no consent banner | 8.0 |
| Fathom Analytics | $15 per month | No. A 7-day trial | None, so no consent banner | 7.4 |
| Pirsch Analytics | $6 per month | No. A 30-day trial, no card required | None, so no consent banner | 7.5 |
| Umami | Free self-hosted and on cloud Hobby | Yes, 100,000 events a month on hosted cloud, plus free self-hosting | None | 7.5 |
| Cloudflare Web Analytics | Free for everyone | The whole product is free | None | 6.9 |
The strongest architecture of the group, and the only one here that adds heatmaps without adding a cookie. Daily rotating salt, no IP written anywhere, 1,270 bytes, and click, scroll and attention maps included from $14.
From $9 per month · None, so no consent banner · Full review →
The most established cookieless tool, EU-hosted, open source and with six years of public track record. No behaviour tooling at any tier.
From £9 per month · None, so no consent banner · Full review →
Cookieless with fifty sites on every plan, which makes it the cheapest per-site option for an agency. Shallow by design, and the harshest overage policy here.
From $15 per month · None, so no consent banner · Full review →
The cheapest serious option at $6, German-hosted, with funnels and A/B testing at $12. Collection stops five days over allowance, which leaves a permanent gap rather than a lockout.
From $6 per month · None, so no consent banner · Full review →
Free, open source and easy to self-host on Node and Postgres, with a genuinely usable free hosted tier at 100,000 events a month.
From Free self-hosted and on cloud Hobby · None · Full review →
Free, cookieless, and on Cloudflare-proxied sites it needs no client-side script at all because the edge already sees the request.
From Free for everyone · None · Full review →
By hashing request attributes such as the IP address and user agent together with a secret salt, then discarding the inputs. The resulting token identifies a visitor within a single day. Because the salt rotates daily and the old one is destroyed, the same visitor produces a different token tomorrow and the two cannot be linked.
For daily and per-page figures it is usually more accurate than a cookie-based tool, because it counts the visitors who would have declined a consent prompt and it is blocked less often. It is less accurate for anything spanning multiple days, such as returning visitors or long attribution windows, and that limitation is inherent rather than a flaw in any one product.
It removes the main reasons consent is required for analytics, since nothing is stored on the device and no identifier is retained. Compliance also depends on your privacy notice, your data processing arrangements and where the data is stored, so treat cookieless as removing the largest obstacle rather than as a complete answer.
Absolutely Analytics includes click, scroll and attention maps from its $14 tier. Matomo includes heatmaps but needs configuring for cookieless operation first, and its Cloud allowance is 1,500 heatmap pageviews a month. Plausible, Fathom, Pirsch and Simple Analytics offer none at any tier.
Everything above is my own opinion, formed from published vendor documentation and pricing read on 11 September 2026. There are no affiliate links on this site and no vendor has paid to appear. Corrections welcome.