What "cookieless" actually means, how these tools count visitors without a persistent ID, and how the leading options really stack up — with a side-by-side table you can act on.
"Cookieless" is a description of mechanism, not a legal guarantee. It means the tracking script does not write a cookie to the visitor's browser to recognize them on a later visit. In the stricter tools it also means the script writes nothing durable to localStorage either — because localStorage is functionally another persistent identifier store, and a "cookieless" tool that quietly parks a UUID in localStorage has simply moved the cookie somewhere the banner rules pretend not to see.
Here is what cookieless does not automatically mean. It does not mean the tool collects nothing — every analytics tool still processes a request that contains an IP address and a User-Agent, because that's how HTTP works. It does not, by itself, mean the tool is GDPR compliant; what happens to that IP after the request is received is the part that decides compliance. And it does not mean the numbers are worse than Google Analytics — in practice cookieless tools often report more traffic, because privacy-respecting scripts are blocked far less often by ad blockers and tracking-protection browsers.
The useful mental model: cookieless is table stakes, not the finish line. Two tools can both be "cookieless" while one discards the IP the instant it has finished computing a hash and the other logs raw IPs to a database for 30 days. Both marketing pages will say "no cookies." Only one of them has actually solved the privacy problem. So the rest of this guide focuses less on the cookieless label and more on the mechanism underneath it: how uniques are counted, what is stored, where it's stored, and whether you can get your data back out.
For a broader survey that isn't limited to cookieless designs, see the wider list of Google Analytics alternatives — this page zooms in specifically on the cookieless subset and how they differ from one another.
If you can't drop a cookie, how do you tell a returning visitor from a brand-new one? The answer nearly every privacy-first tool has converged on is the salted, daily-rotating, per-site hash. It works like this. When a pageview arrives, the server takes a handful of signals it already has — a secret salt, the site's ID, the visitor's IP address and their User-Agent string — concatenates them, and runs them through a one-way hash. It keeps a short slice of that hash as the "visitor" identifier for the day and throws the raw inputs away.
Three design choices turn that from a fingerprint into a privacy feature. First, the salt is secret and rotates, usually once every UTC day; because it's random and then deleted, yesterday's hashes can't be reproduced or reversed tomorrow, so the identifier can't follow anyone from one day to the next. Second, the site ID is part of the input, so the same person visiting two different sites produces two unrelated hashes — it can never behave like a cross-site cookie. Third, the raw IP is never stored; it exists only in memory long enough to feed the hash, then it's gone.
GhostMetrics is a concrete example you can inspect: it computes SHA-256(daily-rotating salt | siteId | IP | User-Agent), truncates the result to 64 bits, salts with 32 random bytes, scopes per site, and rotates and deletes the salt every day (a 48-hour TTL cleans up the old one). Plausible, Fathom, Simple Analytics and Umami all use variations on the same salted-daily-hash idea. The numbers differ slightly in exactly which signals go into the hash and how the day boundary is drawn, but the shape is the same across the category.
The honest trade-off: because the identifier resets every day, cross-day unique-visitor counts are approximate by design. A person who visits Monday and again Wednesday is counted as two "unique visitors" over the week. For pageviews, top pages, referrers, geography and trends this makes no difference at all. If you genuinely need to stitch one human's journey together across weeks, that's precisely the capability the privacy model gives up on purpose — it's a feature, not a bug.
The cookie banner exists because of the ePrivacy Directive (in the UK, PECR) — not, as many assume, because of GDPR directly. ePrivacy says you generally need consent before you store or access information on a user's device, unless that storage is strictly necessary to provide the service the user asked for. A tracking cookie is storing information on the device for a purpose the user didn't request, which is exactly why it triggers a consent prompt.
A genuinely cookieless tool sidesteps that trigger. If the script sets no cookie, writes nothing durable to localStorage, and stores no personal data server-side, then there is nothing being stored on or read from the device that requires consent — so the analytics itself typically needs no banner. This is the practical reason so many teams switch: the banner is a conversion killer and a UX tax, and cookieless analytics is often the single change that lets it go away.
Two honest caveats keep this from being a blanket promise. First, the analytics is only one script on your page. If you still run advertising pixels, embedded video players, live-chat widgets or A/B tools that drop non-essential cookies, you may still owe a banner for those — swapping the analytics doesn't absolve the rest of the page. Second, "cookieless" and "no personal data" have to both be true; a tool that's cookieless but retains IPs server-side has moved the problem, not removed it. Regulators have repeatedly signaled that IP addresses are personal data, so retention still matters even when no cookie is set.
In practice, removing a cookie-based analytics tool is frequently the last domino: once analytics no longer needs consent and you've audited the remaining third-party scripts, the banner can come off entirely. If that's your goal, we walk through it step by step here — ready to drop the banner? How to remove the cookie consent banner — and if you're still weighing whether to keep Google Analytics at all, is Google Analytics itself GDPR compliant in 2026? covers the ongoing EU data-transfer questions that pushed many teams toward cookieless tools in the first place.
Below is a neutral, side-by-side look at the leading cookieless (or cookieless-capable) analytics tools in 2026. To avoid quoting stale numbers, the pricing column describes the model each tool uses rather than a specific dollar figure — the only exact price shown is GhostMetrics', because those facts are ours to state precisely. Always confirm the current plan on each vendor's own site before you commit. GhostMetrics appears here as one row among peers, described the same way as everyone else.
| Tool | Privacy model | GDPR posture | Pricing model | Self-host? | Feature depth |
|---|---|---|---|---|---|
| GhostMetrics | Cookieless + IP-less; salted daily per-site hash; no localStorage; GPC/DNT honored | No cookies, no personal data stored; IP discarded in-memory; EU residency on request | Free forever (1 site); flat $9.99/mo unlimited | No (hosted; tracker source public) | Deep (11 tabs, vitals, funnels, org detection) |
| Plausible | Cookieless; salted daily hash; no persistent ID | Marketed GDPR/CCPA/PECR-friendly; EU-hosted option | Metered by monthly pageviews; paid, free trial | Yes (open source) | Lean-to-moderate; goals, funnels on higher tiers |
| Fathom | Cookieless; hashed, no cross-site ID | Marketed GDPR/CCPA/PECR/ePrivacy compliant | Metered by pageviews; paid, free trial | Hosted (no maintained self-host) | Lean; clean core reporting |
| Simple Analytics | Cookieless; no unique-visitor fingerprint stored | EU-based (Netherlands) hosting; GDPR-focused | Metered by pageviews/events; paid, free trial | Hosted | Lean; privacy-first essentials |
| Umami | Cookieless; salted daily hash | No cookies, no personal data by design | Free self-host; paid hosted Cloud tier | Yes (open source) | Moderate; core + events, custom reports |
| Matomo | Cookieless mode available (cookies on by default) | Full data ownership when self-hosted; consent tooling built in | Free self-host; paid Cloud | Yes (open source) | Very deep (closest to GA feature-for-feature) |
The pattern that jumps out: on the privacy mechanism itself the hosted privacy-first tools are broadly similar — they all use some flavor of the salted daily hash and none of them park a durable ID on your device. Where they genuinely diverge is on the three axes people actually decide by: how deep the feature set goes, how you pay, and whether you can run it yourself. The next three sections take those one at a time.
"Feature depth" is where the cookieless tools separate into two camps: the deliberately minimal (Fathom, Simple Analytics, and Plausible's core) and the do-more dashboards (Matomo, and GhostMetrics). Neither camp is "right" — a minimal dashboard is a feature if a single-number weekly glance is all you want. But if you're replacing Google Analytics for a real product, the capabilities below are the ones you'll miss if they're absent.
Real-time. A live view of who's on the site right now, updating continuously. Almost every tool has some version; the difference is how much detail sits behind it (current page, referrer, country) versus just a live counter. GhostMetrics keeps real-time on even the free tier, with unlimited pageviews.
Core Web Vitals. Field measurements of FCP, LCP, CLS and TTFB collected from real visitors, not a lab test. This matters because Web Vitals feed search ranking and reflect what users actually experience. Most lean analytics tools don't capture vitals at all; GhostMetrics captures all four and can break them down by page and by device, which is where slow templates and heavy mobile pages reveal themselves.
Funnels. Entry-to-goal conversion paths — how many visitors who landed on a pricing page reached checkout. This is a common upgrade-tier or paid feature across the category; GhostMetrics includes funnels plus entry/exit path analysis.
Scroll depth and attention. How far down the page people actually read, and how long they stay engaged rather than just "time on tab." GhostMetrics tracks scroll depth and attention-minutes; most minimalist tools skip this entirely.
Organization / network detection. Identifying the company or network provider behind a visit — useful for B2B ("which accounts are researching us") — done at the network level, never by identifying a person and never by storing an IP. GhostMetrics calls this "Who's Looking" and keeps it strictly company-level. Alongside these, GhostMetrics ships an under-3KB gzipped tracker (versus 45KB+ for GA), UTM/source attribution, composite engagement scores with AI Insights, and custom event tracking — 11 tabs in total. The honest read: if you want the fewest possible numbers, a lean tool wins; if you're consolidating GA's reporting into one privacy-safe dashboard, the deeper tools save you from stitching several products together.
There are really only three ways to pay for cookieless analytics, and the right one depends less on your budget than on your traffic shape.
Metered by pageviews. This is the most common hosted model — Plausible, Fathom and Simple Analytics all price in tiers keyed to your monthly pageviews. It's simple and cheap at low volume, and the tools that use it are well-built and fairly priced. The catch is that your bill is coupled to your success: a post that goes viral, a seasonal spike, or steady organic growth all push you into the next tier. For a content site or anything with spiky traffic, metered pricing means the months you most want to study your analytics are the months the invoice climbs.
Flat. A fixed monthly price regardless of volume. GhostMetrics uses this: a flat $9.99/mo covers unlimited websites and unlimited pageviews with no metering — the number doesn't move when traffic spikes. The fair-use ceiling is stated honestly rather than hidden: if you push into tens of millions of pageviews a month they'll reach out to talk, but there's no silent throttle and no surprise price change. Flat pricing trades "cheapest at tiny scale" for "predictable at any scale," which is the better deal the moment your traffic is unpredictable or growing.
Free self-host. Open-source tools — Umami and Matomo, and Plausible's self-hosted community edition — are free to run; you pay only for the server, the setup time, and the ongoing maintenance (updates, backups, uptime). The software cost is zero; the real cost is your engineering hours. This is the cheapest option in dollars and the most expensive in attention, which makes it a great fit for teams that already run infrastructure and a poor fit for a solo founder who'd rather ship.
Worth stating plainly: GhostMetrics also has a genuinely free hosted tier — $0 forever, no credit card, one site, real-time dashboard, unlimited pageviews. Several strong competitors (Plausible, Fathom) are paid-only with a trial. So "free" exists in two forms — free-to-self-host and free-hosted-tier — and they suit very different teams.
Analytics you can't export is analytics you're renting. Before you commit to any tool, cookieless or not, check three things: can you get your raw-ish data out as CSV, is there an API, and what happens to your history if you cancel.
Self-hosted tools (Umami, Matomo, self-hosted Plausible) give you the strongest possible answer here: the database is literally yours, sitting on your own server, queryable directly. There is no lock-in because there is no one else holding the data. That's the upside of the maintenance burden discussed above — you trade convenience for total ownership.
Hosted tools vary, and this is worth checking per-vendor because it's easy to overlook while everything is going well. The questions that matter: is CSV export included or gated behind a higher tier; is there a documented API so you can pull numbers into your own warehouse or a spreadsheet; and can you share a dashboard read-only with a client or teammate without buying them a seat. GhostMetrics includes CSV export and public, shareable read-only dashboards on its Pro tier, which covers both the "get my data out" and the "let my client see the numbers" cases without lock-in games. Most privacy-first competitors offer exports and APIs too — the differences are in which tier they sit on, so read the fine print.
One subtle lock-in risk specific to cookieless tools: because uniques are computed from a daily-rotating hash, historical per-visitor detail is intentionally thin everywhere. That's fine — you weren't going to reconstruct individual journeys anyway — but it means "export my data" for these tools means aggregate reports (pageviews, sources, geo, events over time), not a list of people. That's the correct amount of data to be portable, and it's a point in the category's favor: there's simply no pile of personal profiles to be trapped inside.
Because "cookieless" sells, some tools wear the label while doing things that undercut the whole point. Here's the checklist we'd run against any vendor's data-handling page — including ours.
localStorage. A UUID parked there is a persistent identifier that dodges the cookie-banner rules on a technicality. GhostMetrics writes nothing to localStorage; it uses sessionStorage, which the browser wipes when the tab closes.Since we're holding others to this bar, here are GhostMetrics' own honest caveats so you can weigh them: the dashboard is hosted and closed-source (only the tracker at /gm.js is public and auditable — the same posture as Fathom or Simple Analytics), and it runs on US Cloudflare by default with EU data residency available on request (you can pin it to Cloudflare's EU jurisdiction). If open-source self-hosting or strict EU-only residency is a hard requirement, GhostMetrics will tell you to use Plausible, Umami or Simple Analytics instead — which is the same advice we'd give. The point of the checklist is that "cookieless" is a claim to verify, not a badge to trust.
Every tool on the table is a legitimate, privacy-respecting choice. Matching one to your situation is mostly about answering four questions honestly.
Do you need to run it yourself? If open-source self-hosting or strict EU-only data residency is non-negotiable — regulated industry, procurement rules, a security team that wants the database on your own servers — go straight to Umami or Matomo (free self-host), or self-hosted Plausible. You'll trade setup and maintenance time for total control.
Do you want the fewest numbers possible? If a clean weekly glance is the whole job and you never want to think about a dashboard, a deliberately minimal hosted tool like Fathom or Simple Analytics is a pleasure to use and gets out of your way.
Is your traffic spiky or growing? If viral spikes or steady growth would make a metered bill unpredictable, a flat-price tool decouples your invoice from your success.
Are you replacing GA's actual reporting? If you rely on funnels, Web Vitals, event tracking and B2B org detection, you want a deep dashboard so you're not stitching three products together.
That last combination — hosted, zero-maintenance, deep features, predictable flat price, genuinely cookieless and IP-less — is the niche GhostMetrics was built for, which is why we've described it as one row all the way down rather than crowning it. The right move isn't to take our word for any of this. It's to go verify it.
We build and dogfood GhostMetrics on our own live sites, which is why we can do something most vendors can't: publish our own real, unfiltered numbers in public. Open the live demo — no signup — and you'll watch your own visit land in the dashboard in real time. Then read the complete tracker source and confirm for yourself that it sets zero cookies, writes nothing to localStorage, and never sends your IP anywhere it's stored. When you're ready, the free tier takes one line of code and no credit card; grow into unlimited sites and pageviews for a flat $9.99/mo whenever you need it.
Start Free — No Card See the live demoThe wider 2026 list, cookieless and not
How to drop the consent banner safely
The EU data-transfer question, explained
Head-to-head privacy analytics
The fundamentals, start to finish
Our real traffic, public, no signup
Disclosure: GhostMetrics is built and operated by Null Agency, the company that published this guide, and it is described here alongside competitors as one option among several. Every GhostMetrics claim on this page is taken directly from its live product and public tracker source, which you're encouraged to verify. Competitor details reflect each vendor's publicly stated model; confirm current pricing and features on their own sites before deciding. Nothing here is paid placement.