Cookieless analytics tools that work without a cookie banner

What "cookieless" means when a vendor claims it

Most of what you read about cookieless analytics is marketing. Vendors slap "cookieless" on a product page if they've dropped third-party cookies but still set first-party tracking cookies for visitor identification. That's a meaningful improvement over Google Analytics 4, but it's not what your visitors mean when they ask "are you tracking me?" — and it's not what GDPR legitimate-interest tests for.

A genuinely cookieless analytics tool sets zero cookies of any kind (tracking, identification, consent, or session) and identifies a visit through a one-way hash of IP + User-Agent + domain + day that the server rebuilds from scratch every 24 hours. That gives you a per-day visitor count. It does not give you cross-day stitching, multi-touch attribution, or a stable user_id — and that's the trade.

Cookieless, cookie-free, consent-free: three claims, three tests

The three phrases get used as if they were synonyms. They aren't, and the gap between them decides whether you can switch the banner off or merely make it smaller.

Read it as a chain: cookie-free is the means, consent-free is the outcome you're after, and the first does not automatically produce the second. A tracker that stores nothing but rebuilds a stable device fingerprint from screen size, installed fonts, and canvas output has removed the cookie and kept the surveillance — the European Data Protection Board treats that case as needing consent exactly as a cookie would. Our walkthrough on how to choose a cookieless analytics platform runs the same test against a live install rather than a claim.

What happens on each request when there is no cookie

The mechanism is simpler than the marketing around it, and knowing the sequence is the fastest way to judge a vendor's claim in an afternoon.

1. The page fires a small beacon. A one-to-three-kilobyte script posts the URL, the referrer, and the viewport width to a collector endpoint. Nothing is read out of the browser's storage, because nothing was put there.
2. The collector sees an IP address and a user agent. Both arrive with every HTTP request whether you asked for them or not. The interesting question is what the server does with them next.
3. A server-side secret joins the input. The secret is generated on the server, never sent to the browser, and replaced on a fixed schedule — usually every 24 hours.
4. One-way hash, then the address is dropped. The server hashes secret + IP + user agent + your domain, keeps the resulting string, and discards the address. The raw IP is never stored.
5. Tomorrow the same person hashes to something else. The secret was replaced overnight, so the visitor ID changes daily and nothing connects Tuesday's session to Friday's.

Two consequences fall out of that design. Your unique-visitor number is a daily figure, so someone who reads you on Monday and again on Thursday appears twice in the weekly total — the count is internally consistent and fine for trends, but it is not a headcount of people. And because the identification work happens server-side after the beacon lands, the tracker gives ad blockers and Safari's storage limits far less to bite on than a cookie-based tag does.

Why this matters for the cookie banner

Under GDPR Article 6(1)(f) — legitimate interest — you can process personal data without consent if three conditions hold: the processing is necessary for a legitimate purpose, the visitor would reasonably expect it, and it doesn't override their rights. Pure cookieless analytics tools claim this exemption because:

1. Nothing persists on the device — no cookie, no storage entry, no identifier of any kind.
2. The visitor ID changes daily, so no key survives to re-identify the same person tomorrow.
3. The aggregate-only outputs (pageviews, sources, durations) genuinely qualify as legitimate operations interest.

Several EU data-protection authorities have accepted that reasoning for aggregate reporting. The vendors that survive scrutiny are the ones publishing their sub-processor list and retention rules, not the ones with the loudest privacy page. Tools that drop a tracking cookie — even a first-party one with a 13-month expiry — fall outside the exemption and need ePrivacy consent. The five situations where the banner genuinely comes off are set out in when you don't need a cookie banner.

The 5 tests a cookieless tool must pass

Every tool on this list passed all five. We deployed each on a clean test domain and inspected the wire payload + response headers in DevTools.

1. Zero Set-Cookie headers on the analytics endpoint, the tracker JS request, and any redirect chain. We monitored 7 days of pageviews.
2. No browser fingerprinting beyond IP+UA — no canvas hashing, no font enumeration, no WebGL, no audio context.
3. Daily identifier turnover documented in vendor docs OR observed through 24-hour visitor-count divergence on a controlled stable-traffic test.
4. Public Schrems II posture for tools claiming EU-only data residency, with named sub-processors and SCC documentation.
5. No consent banner shipped with the tracker by default. If installation requires a consent flow, the tool failed.

The honest trade-off

Going cookieless costs you three things, and they're worth knowing before you migrate from GA4:

• Cross-day visitor stitching is gone. Every Safari user counts again tomorrow. Your "monthly active users" number will look smaller than GA4's — not because traffic dropped, but because the math changed.
• Multi-session attribution stops at 24h. If a buyer visits Tuesday from a LinkedIn ad, leaves, and converts Friday from a direct visit, GA4 stitches that together. Cookieless tools see two visitors. You'll need a server-side join (BigQuery export + your own logic) for true LTV attribution.
• Custom user_id event chains break. If you instrument custom events with a logged-in user identifier, that's no longer cookieless from the user's perspective. Tools accommodate this with optional consent prompts for logged-in flows, but the "no banner" claim only applies to anonymous visitors.

If those three losses are deal-breakers for your team, you don't want a cookieless tracker — you want a privacy-friendly tracker with documented consent-management, like Matomo or Piwik PRO with cookies enabled. We list those on the GDPR-compliant tools page instead.

Cookieless analytics is not cookieless advertising

Search the word on its own and half the results are ad tech: identity graphs, data clean rooms, first-party data onboarding, cookieless personalisation engines. Those products solve the opposite problem. They exist to keep recognising the same person after the third-party cookie went away, usually by matching hashed emails or by buying into a shared ID. The cookieless tracking tools on this page exist to stop recognising people and report on traffic regardless.

The confusion has a price. Teams shopping for a cookieless measurement tool get pitched an identity platform, sign a processing agreement that assumes personal data throughout, and land back at the banner they were trying to remove. If your question is "how many people read this page and where did they arrive from", this list answers it. If your question is "recognise this buyer across three devices and a paid channel", nothing here will do that, and the consent-free version of that requirement does not exist at any price.

The middle ground — measuring a funnel across steps without an identifier that follows people around — is a real technique with real limits. We work through four approaches to funnel analytics without cookies separately, including the two that survive contact with a real checkout.

Free cookieless analytics options (no banner, no $9/mo)

If you want cookie-free analytics and a free price tag, you have three categories:

1. Permanently free Cloud tier — Umami Cloud (free Hobby tier), Simple Analytics (free plan, five sites, their badge on your pages, 30 days of history), GoatCounter (free for personal/SMB, donation-supported). All three are cookie-free and don't need a banner.
2. Permanently free self-host — Plausible Community Edition (AGPL-3.0, Elixir + ClickHouse), Umami (MIT, Next.js + Postgres), Matomo (GPL-3.0, PHP + MySQL — needs to be configured for cookieless mode), GoatCounter (EUPL-1.2, single Go binary on SQLite). Free in license, $5/mo VPS in reality.
3. Trial-only "free" — Plausible Cloud (30-day trial), Fathom (7-day trial), Pirsch (30-day trial). After that you pay. Don't confuse these with the permanent free options above.

For most operators wanting free cookieless analytics, the choice is between Umami self-host (zero recurring cost, 30 min ops/month) or Simple Analytics free tier (zero ops, 5-site cap). If you run more than 5 sites and don't want to pay anything, Umami self-host is the only path.

Which cookieless analytics platform fits which job

Every tool below clears the privacy bar, so choosing between them is a question about your operation rather than about tracking ethics. This is where teams usually land, sorted by the job they came to do. Prices are entry tiers checked against vendor pages; the per-tool reviews carry the full ladder.

One name below needs a note before you shortlist it. Wide Angle Analytics shut down on 31 August 2026 and is listed here for reference only; the vendor issued a downloadable snapshot of customer data rather than an export button inside the interface. Among the smaller open-source entries, check the commit history before you build a reporting habit — several have gone quiet for the better part of a year.

If you ship a mobile or desktop app rather than a website, this list is the wrong category — see app-analytics tools instead. App SDKs operate on different technical principles and the cookieless framing doesn't map cleanly.

Cookieless analytics questions we keep getting

Is cookieless analytics legal in the EU without a banner?

For a tool that stores nothing on the device and keeps nothing that traces back to a person, yes. ePrivacy Article 5(3) only bites when something is stored on or read from the device, and the GDPR question turns on whether what you retain still identifies someone. Both conditions have to hold together, and they stop holding the moment you switch on a returning-visitor report or a long attribution window. Either way you still name the tool in your privacy notice.

Does cookie-free analytics undercount traffic?

It counts differently rather than less. Sessions and pageviews are measured the same way; unique visitors become daily uniques, so a weekly figure adds up days instead of deduplicating people. Most sites see their totals go up after the switch, because no banner stands between the visitor and the measurement and the people who would have declined it are counted like everyone else.

How is this different from consent mode in GA4?

Consent mode keeps the cookie-based design and fills the hole with modelling when a visitor declines. The banner stays up, and the data for refusers is estimated rather than observed. A cookieless tool has no cookie to consent to, so there is nothing to model. Two answers to the same problem, and only one of them removes the banner.

Can I run a cookie-free tool while my consent banner is still up?

Yes, and it's the usual migration path: install the cookie-free tool outside the banner's blocking rules, run both for a month, then compare. The two numbers will not match, because one tool only ever saw the people who agreed. Once the size of the gap stops surprising you, drop the analytics category from the banner. The sequencing — and what it does to conversion rate — is covered in what to do when a consent banner is costing you conversions.

Does cookieless mean visitors can't be identified?

No. Cookieless describes what the tool refuses to put on the device. Whether a visitor stays unidentified depends on what the server keeps: a tool that retains raw IP addresses, or that stitches sessions with a device fingerprint, is cookieless and identifying at the same time. The question worth asking a vendor is not "do you set a cookie" but "can you recognise me tomorrow" — tracking website traffic without creeping on your users works through what that answer means for an ordinary site.