You can track every visitor, session, and conversion on your site without setting a single cookie and without a consent banner getting in the way. This guide shows you exactly how cookieless tracking works and how to set it up on your own site in under five minutes.
The Short Answer
Cookieless analytics tools identify a visitor with a temporary, salted hash instead of a stored cookie. That hash gets built from signals like the visitor's IP address, user agent string, and the date, then it rotates every 24 hours so nobody can be followed from one day to the next.
No cookie file ever touches the browser. Nothing gets stored, nothing for an ad blocker to strip, and nothing that triggers a consent banner under GDPR or ePrivacy rules. You still get real visitor counts, session data, referrers, and conversion tracking. You just lose the ability to follow one person across weeks or months, which almost no site owner actually needs for day-to-day decisions.
Why Cookies Were Never Really Necessary
Google Analytics leans on cookies because it was built for long-term audience profiling: remarketing lists, cross-session identity, ad attribution spread across multiple properties. Most site owners never touch any of that. What you actually need to know is a lot simpler:
- How many people visited today, and which channel sent them.
- Which pages convert, and which ones quietly leak visitors before checkout.
- Whether a campaign paid off, not the personal identity of the person who clicked it.
None of that requires recognizing a specific returning human. It just requires counting sessions correctly, and cookieless methods do that fine.
Method 1: Rotating Salted Hashes
This is the standard approach behind most modern privacy-first analytics tools. Pelagic, for one, uses this method to give you live visitor data with zero cookies set. Here's what actually happens under the hood:
- A visitor loads your page. The tracking script fires once and reads the IP address, user agent, and domain.
- The server combines those values with a daily salt. The salt changes every 24 hours, so the same visitor produces a completely different hash tomorrow.
- The hash becomes a temporary session ID. It tells one session apart from another, but it can't be reversed into an IP address and can't be matched across days.
- The raw IP gets discarded immediately. It's never stored, logged, or written to disk anywhere.
The result is an accurate session count and a real unique-visitor count for the day, with no persistent identifier ever existing to leak, get subpoenaed, or get misused.
Method 2: Server-Side and Edge Aggregation
Some setups skip client-side scripts almost entirely and count visits straight from server logs or edge functions. A request hits your server or CDN, gets logged with basic metadata like URL, referrer, and device type, and rolls up into daily totals. In the strictest versions, no script runs in the browser at all.
This works, but it has real gaps. You lose most JavaScript-based events, so button clicks, form submissions, and single-page-app route changes are hard to capture accurately this way. It also takes real engineering time to build and maintain a log-parsing pipeline, which is exactly the kind of infrastructure most founders would rather not own. That's why most teams run a lightweight script built on rotating hashes instead of rolling their own log-based system from scratch.
Method 3: First-Party, Event-Based Tracking
This is a layer on top of Method 1, not a separate system. Instead of only counting pageviews, you fire custom events for the moments that actually matter to revenue: signup completed, trial started, plan upgraded, order placed. Each event still rides on the same cookieless, hashed session, so you see "this session converted" without ever knowing whose session it was.
This is the part most cookieless-tracking explainers skip, and it's the one that matters most if you're running a SaaS product or an online store. Raw visitor counts are vanity metrics. Visitor counts tied to trial starts, purchases, and MRR are the whole point.
Example: a B2B SaaS site sees 6,000 sessions from an organic blog post this month, but the event data shows only 35 of those sessions triggered a "trial started" event. That single number tells you more about the post's real value than the 6,000 figure ever could, and you didn't need one cookie to get it.
Example: an ecommerce store runs a paid social campaign that drives 2,500 clicks. Event tracking shows the campaign produced 18 completed checkouts worth $940 in revenue, letting you calculate real return on ad spend instead of guessing from click volume alone.