How Cookieless Analytics Tracks Visitors Without Cookies
SaaSNa.me · September 5, 2026
"Cookieless" is easy to claim and hard to verify. The honest version of the claim is specific about the mechanism, so here's ours, in full.
The identity problem
To report "3 visitors" instead of "9 pageviews," an analytics tool needs some way to tell that two requests came from the same person without storing anything on their device. The only inputs available for that, without writing to the browser, are the headers a request already sends: IP address and User-Agent.
The mechanism
A visitor's session id is computed as a hash of a rotating salt, the request's IP address, its User-Agent string, and the site's domain — nothing else.
IP and User-Agent are headers the browser sends on every request regardless of this tool's existence, so reading them is passive processing, not "gaining access to information stored in terminal equipment" — the specific trigger ePrivacy regulates. Including the site's domain in the hash means the same visitor on two different customers' sites produces two unrelated ids, so cross-site tracking isn't possible even in principle.
Why the salt matters more than the hash
Hashing alone isn't enough — a fixed salt can be brute-forced back to the original IP and User-Agent, since both have far less entropy than a real secret. The salt has to be random, non-public, and short-lived. A daily rotating salt, destroyed after 48 hours, means that once it's gone, the resulting id can't be reversed or re-linked by anyone, including us. That destruction is what makes the identifier genuinely anonymous rather than merely disguised.
Two salts stay valid at once, so a session that spans midnight resolves to one visitor instead of splitting into two.
What this deliberately doesn't include
Screen size, timezone, installed fonts, canvas rendering — every one of these would sharpen the identifier, and every one of them is also a fingerprinting signal that moves the mechanism toward exactly what consent law regulates. The identity input stays limited to headers the browser sends passively, on purpose, even though adding more signals would make the visitor count more precise.
The tradeoff, stated plainly
Because the salt rotates and destroys itself, this identifier cannot track anyone across more than about two days, and it was never meant to. It answers "how many distinct visitors" and "did the same person view three pages in one session" — not "is this the same person who visited last month." That boundary is the actual cost of not using cookies, and no vendor should tell you otherwise.