Cookieless analytics tools that work without a cookie banner

What "cookieless" actually means in 2026

Most of what you read about cookieless analytics is marketing. Vendors slap "cookieless" on a product page if they've dropped third-party cookies but still set first-party tracking cookies for visitor identification. That's a meaningful improvement over Google Analytics 4, but it's not what your visitors mean when they ask "are you tracking me?" — and it's not what GDPR legitimate-interest tests for.

A genuinely cookieless analytics tool sets zero cookies of any kind (tracking, identification, consent, or session) and identifies a unique visitor through a daily-rotated salted hash typically derived from IP + User-Agent + domain + day-bucket. The hash gives you yesterday's pageview-per-visitor count. It does not give you cross-day stitching, multi-touch attribution, or a stable user_id — and that's the trade.

Why this matters for the cookie banner

Under GDPR Article 6(1)(f) — legitimate interest — you can process personal data without consent if three conditions hold: the processing is necessary for a legitimate purpose, the visitor would reasonably expect it, and it doesn't override their rights. Pure cookieless analytics tools claim this exemption because:

1. No personal data persists on the device — the daily hash is rotated and unrecoverable.
2. The data leaves the visitor's control window with no identifier that re-identifies them tomorrow.
3. The aggregate-only outputs (pageviews, sources, durations) genuinely qualify as legitimate operations interest.

EU data-protection authorities have accepted this argument for tools like Plausible (German DSK 2022 review), Fathom (Schrems II posture documented), and most of the AGPL self-host options. Tools that drop a tracking cookie — even a first-party one with a 13-month expiry — fall outside this exemption and need ePrivacy consent.

The 5 tests a cookieless tool must pass

Every tool on this list passed all five. We deployed each on a clean test domain and inspected the wire payload + response headers in DevTools.

1. Zero Set-Cookie headers on the analytics endpoint, the tracker JS request, and any redirect chain. We monitored 7 days of pageviews.
2. No browser fingerprinting beyond IP+UA — no canvas hashing, no font enumeration, no WebGL, no audio context.
3. Daily salt rotation documented in vendor docs OR observed through 24-hour visitor-count divergence on a controlled stable-traffic test.
4. Public Schrems II posture for tools claiming EU-only data residency, with named sub-processors and SCC documentation.
5. No consent banner shipped with the tracker by default. If installation requires a consent flow, the tool failed.

The honest trade-off

Going cookieless costs you three things, and they're worth knowing before you migrate from GA4:

• Cross-day visitor stitching is gone. Every Safari user counts again tomorrow. Your "monthly active users" number will look smaller than GA4's — not because traffic dropped, but because the math changed.
• Multi-session attribution stops at 24h. If a buyer visits Tuesday from a LinkedIn ad, leaves, and converts Friday from a direct visit, GA4 stitches that together. Cookieless tools see two visitors. You'll need a server-side join (BigQuery export + your own logic) for true LTV attribution.
• Custom user_id event chains break. If you instrument custom events with a logged-in user identifier, that's no longer cookieless from the user's perspective. Tools accommodate this with optional consent prompts for logged-in flows, but the "no banner" claim only applies to anonymous visitors.

If those three losses are deal-breakers for your team, you don't want a cookieless tracker — you want a privacy-friendly tracker with documented consent-management, like Matomo or Piwik PRO with cookies enabled. We list those on the GDPR-compliant tools page instead.

Free cookieless analytics options (no banner, no $9/mo)

If you want cookie-free analytics and a free price tag, you have three categories:

1. Permanently free Cloud tier — Umami Cloud (Hobby, 100k events/mo), Simple Analytics (Free, 5 sites), GoatCounter (free for personal/SMB, donation-supported). All three are cookie-free and don't need a banner.
2. Permanently free self-host — Plausible Community Edition (AGPL-3.0, Elixir + ClickHouse), Umami (MIT, Next.js + Postgres), Matomo (GPL-3.0, PHP + MySQL — needs to be configured for cookieless mode), GoatCounter (EUPL-1.2, single Go binary on SQLite). Free in license, $5/mo VPS in reality.
3. Trial-only "free" — Plausible Cloud (30-day trial), Fathom (30-day trial), Pirsch (30-day trial). After that you pay. Don't confuse these with the permanent free options above.

For most operators wanting free cookieless analytics, the choice is between Umami self-host (zero recurring cost, 30 min ops/month) or Simple Analytics free tier (zero ops, 5-site cap). If you run more than 5 sites and don't want to pay anything, Umami self-host is the only path.

How to pick from this list

The Plausible default works for most content sites — clean dashboard, fast tracker, EU-hosted, $9/mo entry, single-screen analytics that loads in under a second. If you're a SaaS team with paid LinkedIn campaigns and want better source attribution: Fathom. If you're self-hosting on a $5 VPS and refuse to pay for analytics: Umami (MIT license, Postgres backend, single Docker image).

If you ship a mobile or desktop app rather than a website, this list is the wrong category — see app-analytics tools instead. App SDKs operate on different technical principles and the cookieless framing doesn't map cleanly.