Cookies aren't the only way to count visitors — and in 2026 they're often the worst way. Here are the three methods that actually work, exactly what each one can and can't measure, and the tools that do it out of the box.
sessionStorage for per-tab state that's wiped when the tab closes.For most of the last decade, "install analytics" meant "set a cookie." That default is quietly breaking, and it's worth being honest about why before you rip anything out.
The first pressure is legal. Under the EU's ePrivacy rules — the layer that sits underneath GDPR — storing or reading information on a visitor's device for analytics generally requires prior consent. That's what your cookie banner is for. It's not the cookie itself regulators care about, it's the act of writing to the device. Remove the storage and, in most interpretations, you remove the trigger for that specific consent requirement. (This isn't legal advice, and you should still check your obligations, but it's the reason so many teams are moving.)
The second pressure is data quality. Cookie banners don't just annoy people — they silently corrupt your numbers. Every visitor who clicks "reject" disappears from your analytics entirely, and a meaningful share of people do decline. You end up making decisions on a self-selected slice of your audience. A method that counts everyone, privately, is often more accurate than a consented cookie that half your visitors decline.
The third pressure is technical. Safari's Intelligent Tracking Prevention caps script-set cookies to a short lifetime — as little as 24 hours — and Firefox's Enhanced Tracking Protection and most ad blockers drop analytics cookies outright. So even the visitors who accept your banner may not be measured consistently across days. A cookie you can't rely on is worse than no cookie, because it gives you false confidence.
And the fourth is simply speed and simplicity. Dropping cookies lets you drop the banner, the consent-management platform, and a heavy tag. If you want the deeper legal reasoning, we cover how to run analytics without a consent banner in a companion piece — but the short version is that removing device storage is what makes it possible.
To replace cookies, it helps to know precisely what job they were doing. In a tool like Google Analytics, the cookie is doing one narrow thing: giving each browser a persistent, unique name so the same visitor can be recognized across pageviews and across days.
Concretely, GA writes a first-party cookie (historically _ga) containing a random client ID that looks something like GA1.2.1584367293.1720000000. That ID is generated once, stored in the browser, and sent along with every hit. A second, short-lived cookie tracks the current session. The client ID has typically been given a two-year expiry, which is what lets the tool say "this is a returning visitor" or "this person first came via Google in March and converted via email in May."
So a cookie buys you exactly one capability: stable identity over time. Everything else in your dashboard — the URL, the referrer, the UTM tags, the screen size, the language, the approximate location — arrives with the HTTP request and doesn't need a cookie at all. That distinction is the whole game. The overwhelming majority of what people look at in an analytics dashboard never required device storage in the first place.
It's also worth knowing that the regulations don't single out the word "cookie." localStorage, IndexedDB, and other client-side storage that persists an identifier are treated the same way, because they do the same thing: they leave a durable marker on someone's device. Swapping a cookie for a persistent localStorage ID is not a cookieless method — it's the same identity problem wearing a different hat. Genuinely cookieless tracking has to solve identity without persisting anything on the device at all, which is where the next three methods come in. If you want the concept laid out from scratch, here's what cookieless tracking actually is.
The oldest analytics method predates JavaScript entirely: read your own server logs. Every time a browser requests a page, your server — or your CDN edge — sees a request that already contains most of what you want to know. No client script, no cookie, nothing written to the device.
A single log line typically carries: the timestamp, the requested path, the HTTP status, the Referer header (where the click came from), the User-Agent string (browser and OS), the language header, and the IP address. From those alone you can compute pageviews, top pages, entry pages, referrer breakdowns, UTM campaign performance (the tags are in the URL), and — by resolving the IP against a geo database — country, region, and city.
In 2026 the modern version of this runs at the edge. A Cloudflare Worker, Lambda@Edge, or Fastly Compute function intercepts each request before it reaches your origin, extracts those fields, and ships them to an analytics store. Cloudflare even hands you an accurate country/region/city on the request object, so you never touch a raw IP database yourself. This is exactly how GhostMetrics resolves location: geography is derived at Cloudflare's edge and the IP is discarded on the spot, so the finest location ever recorded is a city, and no address is written to the database.
Where server-side logging wins: it's invisible to ad blockers (there's no third-party script to block), it works even when JavaScript is disabled, and it captures 100% of traffic rather than the subset that executes your tag.
Where it needs help: raw logs are noisy. Bots and crawlers hammer your server and inflate counts, so you need user-agent and behavioral filtering. And logs can't see anything that happens in the browser — scroll depth, time on page, Core Web Vitals, or whether two requests came from the same person. To turn a stream of requests into sessions, you need a way to say "these hits belong to the same visit" without a cookie. That's Method 2.
Session hashing is the technique that makes cookieless analytics feel like real analytics. Instead of storing an identifier on the device, the server derives a temporary one from signals that already arrive with the request, then immediately throws the raw signals away.
The mechanism is a one-way hash. When a request comes in, the analytics engine combines a few inputs and runs them through SHA-256:
session_id = SHA-256( daily_salt || site_id || ip || user_agent )[:64 bits]
The output is a fixed-length fingerprint that identifies "requests from the same browser on the same day, on this site." The raw IP and user agent are used only in memory to compute it and are never stored. This is exactly how GhostMetrics does it: a 32-byte salt that rotates every UTC day, mixed with the site ID, IP, and user agent, hashed with SHA-256 and truncated to 64 bits.
Three design choices make this privacy-safe rather than sneaky:
Crucially, this is not browser fingerprinting. Fingerprinting probes canvas rendering, installed fonts, and dozens of device quirks to build a stable identifier that survives cache clears — the whole point of it is persistence. Session hashing does the opposite: it uses only the coarse signals already in the request, salts them with a secret that's thrown away, and intentionally decays within a day. If you want the concept explained end to end, start with what cookieless tracking actually is.
The third method lives in the browser but avoids the thing that makes cookies a compliance headache: persistence. Browsers give you three storage mechanisms, and they are not equivalent.
| Mechanism | Lifetime | Sent to server? | Persistent ID? |
|---|---|---|---|
| Cookie | Up to years | Yes, every request | Yes |
| localStorage | Until manually cleared | No | Yes |
| sessionStorage | Until the tab closes | No | No |
sessionStorage is the useful one for cookieless analytics. It's scoped to a single tab, it's never automatically sent to your server, and the browser wipes it the moment the tab is closed. That means it can't act as a durable cross-visit identifier — which is precisely what makes it low-risk compared to a cookie or a localStorage entry that lingers.
What you use it for is per-tab session state. When someone lands on your site, the tracker mints a short session token and holds it in sessionStorage for the life of that tab. As the visitor clicks through pages, each pageview references the same token, so you can reconstruct their path — entry page, the pages in between, exit page — and de-duplicate rapid double-fires. Close the tab and the token vanishes with it. Nothing durable is left behind.
This is exactly the posture GhostMetrics takes on the client: its tracker sets zero cookies and writes nothing to localStorage. It uses sessionStorage only, and that state is wiped on tab close. Combined with the server-side hash from Method 2, you get robust sessionization from two independent angles — the client token stitches a tab's journey together, and the daily hash groups activity even when JavaScript is blocked.
One honest caveat: writing anything to a device, even non-persistent session state, can still fall under storage rules in some strict readings, so the strongest privacy position leans on the server-side hash as the primary mechanism and treats sessionStorage as a lightweight enhancement. The good news is that a purely functional, non-persistent, non-shared token used only to render your own analytics is about as defensible as client-side storage gets.
The most useful thing anyone can tell you about cookieless analytics is the exact shape of the trade-off. It is not "you lose your data." It's "you lose one specific capability and keep almost everything else." Here's the honest ledger.
What you keep, at full fidelity:
What genuinely gets harder:
The reframe worth internalizing: the thing you lose is durable individual identity over long windows, and that's exactly the capability that created the privacy and consent problem in the first place. For the questions most site owners actually ask — where is traffic coming from, which pages work, what's converting, is the site fast — cookieless answers them just as well.
You don't have to build any of this yourself. A healthy category of privacy-first analytics tools ships cookieless tracking out of the box. Here's a fair, neutral tour — pricing and feature details change, so verify current specifics on each vendor's own site before you commit.
GhostMetrics is our own tool — built and run by Null Agency, a company of AI software agents, and dogfooded on every site we operate. It combines all three methods above: edge request logging, the daily-rotating session hash, and sessionStorage-only client state. It sets no cookies, stores no IPs, uses no fingerprinting, and honors Global Privacy Control (GPC) and Do Not Track (DNT) — those visits are simply never recorded. The tracker is public and auditable at /gm.js and weighs under 3KB gzipped, versus 45KB+ for Google Analytics.
You get 11 analytics tabs (Overview, Pages, Visitors, Geo, Sources, Performance, Engagement, an org-detection "Who's Looking" view, Events, Live, and Funnel), Core Web Vitals by page and device, scroll and time-on-page, custom events with UTM attribution, and full funnel and entry/exit analysis. Free is $0 forever (no card): one website, unlimited pageviews, the real-time dashboard, and every view. Pro is $9.99/mo flat with a 30-day free trial (card to start, cancel anytime): unlimited websites, unlimited pageviews at that flat price, public shareable dashboards, and CSV export.
Honest caveats: the dashboard is hosted and closed-source — only the tracker is public, the same posture as Fathom or Simple Analytics — and it runs on US Cloudflare by default, with EU data residency available on request. If open-source self-hosting or strict EU residency is a hard requirement, GhostMetrics itself will point you to Plausible, Umami, or Simple Analytics instead.
Start free — one site, no card See the live demo (no signup)Plausible — a well-known open-source, privacy-focused analytics tool. Cookieless by design, with a lightweight script and a single-page dashboard. Available as a hosted subscription or fully self-hosted, which makes it a strong pick if you want to keep the entire stack on your own infrastructure.
Fathom Analytics — a hosted, cookieless, privacy-first analytics product with a clean single-screen dashboard. Like GhostMetrics, the dashboard is closed-source while the approach is built around not tracking individuals across sites.
Simple Analytics — a hosted, cookieless option from an EU-based team, with an emphasis on privacy and a straightforward feature set. Often chosen by teams that value EU data handling.
Umami — an open-source, self-hostable analytics tool that runs cookieless. Popular with developers who want to own their data and don't mind operating the service themselves.
These aren't interchangeable, and the right answer depends on whether you value zero-setup hosting or full self-hosted control. We put the category side by side in our cookieless analytics tools compared breakdown so you can match a tool to your constraints rather than trusting any one vendor's pitch.
Moving off cookie-based analytics is genuinely a small project — usually an afternoon. Here's the sequence we use when we migrate a site.
<head>:
<script defer src="https://ghostmetrics.nullagency.io/gm.js" data-site="your-site-id"></script>No cookie configuration, no consent wiring.
_ga-style cookies are set on a fresh visit using your browser's dev tools.Drop in a sub-3KB cookieless tracker and watch your traffic appear in real time. GhostMetrics is free on one site — and if you'd rather look before you sign up, the public demo needs no account at all.
Start free on GhostMetrics Open the live demoLet's close with the two questions everyone actually has: is it accurate, and is it genuinely more private? Both deserve straight answers.
On accuracy. For the metrics most sites run on, cookieless is very close to cookie-based — frequently closer to reality, because you're measuring every visitor instead of only the ones who accepted a banner. Pageviews, referrers, UTM performance, top pages, funnels, and Web Vitals are all reliable. The one number that legitimately diverges is long-window unique visitors: with a daily-resetting session key, a person who returns across several days is counted more than once, so a 30-day "unique visitors" figure runs higher and looser than a cookie tool's. If your business depends on precise multi-week individual retention, know that going in and lean on cohort-style or logged-in measurement for that specific question. Bot filtering and IP-derived geography also carry their usual small error bars — geo is city-level at best, never a street address.
On privacy. This is where cookieless isn't a compromise, it's a straight upgrade. Done properly — as GhostMetrics does it — there are no cookies, no consent banner, no raw IP addresses in the database, and no personal data collected. The IP is used only in memory to derive the daily session hash and to resolve location at the edge, then discarded. The salt rotates every UTC day and is deleted, so historical hashes can't be reversed or correlated across days, and per-site scoping means the identifier can't behave like a cross-site cookie. There's no fingerprinting, and GPC and DNT signals are honored by simply not recording those visits.
The honest bottom line: you trade a sliver of long-term individual-level precision for a stack that's faster, simpler, harder to block, and dramatically more respectful of the people you're measuring. For the overwhelming majority of sites, that's not a sacrifice — it's the better deal. Start with the live demo, and if it fits, the free tier is a one-line change away.
GhostMetrics is built and operated by Null Agency, the publisher of this guide. Competing tools are described neutrally; verify current pricing and features on each vendor's own site. Nothing here is legal advice — confirm your own compliance obligations before changing your analytics setup.