What is cookieless analytics?

What is cookieless analytics?

Cookieless analytics is web measurement that stores nothing on the visitor’s device and reads nothing from it. No cookie, no localStorage, no identifier that survives the day. The visitor arrives, gets counted, leaves. Tomorrow your site does not know them.

The difference to classic tools is not the dashboard. It is what happens in the browser. Google Analytics 4 sets a first-party cookie called _ga so it can recognise the same browser on later visits. Storing that cookie on the device is what requires consent under § 25 TDDDG. Cookieless analytics drops the cookie, and with it the reason for the prompt. We go through the details in our comparison with Google Analytics.

That sounds like a loss. For most site owners it is a trade. You give up knowing that Tuesday’s visitor came back on Friday. You keep everything that tells you whether the site works.

How do you count visitors without a cookie?

Creo Analytics counts visitors with a hash that changes every day. For each request, the server combines a random daily salt, the website’s measurement ID, the IP address and the browser’s user agent string, and hashes them. The result is a short pseudonym: identical for the same browser within one day, different tomorrow. The IP address is discarded right after. It is never written to disk.

The salt is the key to the whole thing. It is 32 random bytes, generated in memory, rotated at midnight (Europe/Berlin) and never stored anywhere. Once it changes, yesterday’s pseudonyms cannot be recomputed, not even by us. There is no list of visitors. There is a count of pseudonyms per day.

The measurement ID is part of the hash on purpose. The same person on two websites that both use Creo Analytics gets two unrelated pseudonyms. Cross-site profiles are not just forbidden by contract. They are impossible by construction.

One honest footnote: if the server restarts, it draws a fresh salt, and that day’s visitor count comes out slightly high. We say so rather than smooth it over.

How do you get monthly visitors if the hash resets every day?

You estimate them. Daily pseudonyms cannot be added up: a visitor who comes on Monday and again on Tuesday is two different hashes, and summing the days would count them twice. Creo Analytics solves this with HyperLogLog. For every day, the aggregator stores a small statistical sketch of 4 KB instead of the hashes. Sketches can be merged over any period, and the error of the estimate stays under 3 %.

A sketch contains no pseudonym at all. That is why the daily aggregates can be kept for 26 months by default, while the raw events are deleted after 14 days.

So: page views are exact. Visitors per day are exact. Visitors per week, month or year are an estimate, and the dashboard says so next to the number.

What do you lose without a cookie?

Recognition. In cookieless mode, Creo Analytics cannot tell a new visitor from a returning one, cannot follow a person across several days and cannot build a profile. That means:

• No “new versus returning” split.
• No visitor journeys across several days.
• No session replay. That needs consent.
• No retargeting. There is no advertising ID to hand to anyone, and nothing goes to advertising networks.

What you keep is the longer list: page views, visitors, sessions, bounce rate, time on page, sources and UTM campaigns, countries, devices, browsers, operating systems, real time. Click and scroll heatmaps per page and device, as aggregates. Funnels with the drop-off per step. Segments by device, country, source, browser or system. Custom events with properties, reported with one line of JavaScript. PDF reports by email, weekly to yearly. For websites hosted with Creo Digital, Core Web Vitals, load times, uptime and error pages on top.

Why is that enough for most of your questions?

Because the questions a site owner actually asks are about the site, not about a person. Which page gets read. Where the traffic comes from. Whether the campaign worked. Where people drop out of the checkout. Whether the page is slow on phones. Not one of these needs a cookie.

A cookie remembers a person. A hash remembers that someone was there. By midnight, even that is gone.

Our rule of thumb: if your question starts with “which page” or “where from”, cookieless answers it. If it starts with “which person”, you are asking for a profile, and the first thing to ask is whether you need one. There is also a number consent-gated tools cannot count: the visitors who clicked “reject”. Cookieless counts them all, because there is nothing to reject.

When do you need the full mode?

When the question really is about a person over time. New versus returning visitors, journeys across several days, or session replay with a masked page, no plain-text inputs. For that, Creo Analytics sets a first-party cookie after opt-in, and you need a consent banner. Before the visitor consents, the same script measures cookieless, so nobody who declines disappears from your statistics. After the beta, the full mode costs €25 per website and month, cookieless €10.

As of: September 2026. Switching to full mode goes through a deliberate gate: three separate confirmations, the domain typed out, the step logged. The way back to cookieless is immediate and deletes recordings and consent pseudonyms. The aggregates stay, because they were never personal. The documentation walks through both modes and the consent interface.

Is cookieless analytics legal without a banner?

In our assessment, yes. § 25 TDDDG requires consent for storing information on the device or reading information from it. Cookieless mode does neither. The processing itself rests on legitimate interest, Art. 6(1)(f) GDPR. That is our reading of the wording, not a court ruling, and not legal advice. The longer answer is on do you need a cookie banner for web analytics.

One thing we say out loud: supervisory authorities do not judge uniformly whether reading the user agent string falls under § 25. The salted daily hash is established practice, it is how Plausible counts and how Matomo can be configured, but it is not a zero-risk method. If you want zero, count page views only, with no visitor number at all. We would rather tell you that than sell you certainty. Either way, Do Not Track and Global Privacy Control are honoured, and any visitor can object at platform.creoanalytics.com/widerspruch.