How cookie-less tracking works, and what it can tell you
Cookie-less analytics counts visits with a random code stored on your own website. Here is how it works in plain words, and what it can and cannot tell you about your marketing.
On this page
The short version
The short version- Cookie-less tracking gives each browser a random code, kept in storage that belongs to your website alone. Nothing about the person goes into it
- It counts a browser, not a person. The same customer on a phone and a laptop is two visitors until something joins them up
- Journeys split in three ordinary places: a second website (like your booking site), a link opened on a different device, and a week of Safari without a visit
- It is good at the question an owner actually asks: which marketing sent people, and how far did they get
- It does not settle whether you need a consent banner. That is a question for whoever advises you
Cookie-less tracking counts website visitors without a cookie. The tracking script makes up a random code for each browser, keeps it in that browser's storage for your website only, and sends it with each page view. That code is the whole identifier, and it names a browser rather than a person.
That one fact explains nearly everything worth knowing: why one customer can sometimes show up as two visitors, why a cookie would not have fixed that, and why the comparisons are still trustworthy. Here is how it works, told through one business, and what it means when you sit down on a Friday to work out which of this month's marketing did anything.
What the visitor code actually is
Take a small language school. This month it sent a newsletter, posted twice in a local parents' group, and paid for a listing in a directory of evening classes. On Friday the owner wants to know which of the three sent people to the course pages, and how many of them got as far as the enquiry form.
Every one of those visitors gets a random code the first time their browser loads the school's website. It is a long string of random characters, generated by the browser and kept in what is called localStorage: a small box of storage that only the school's own website can open. Nothing about the person goes into the code. Not their device, not their screen size, not their address. It is rolled like a dice, not worked out from anything.
It forgets on its own. In Funnel Analytics a visit refreshes the code's date, and a code unused for about six months is thrown away. A browser that stops coming back is simply forgotten.
Lose the code and you lose the visitor. If somebody clears their browser data, they come back as a new visitor. That is the honest cost of not fingerprinting anyone: there is nothing to work the code out again from.
Why that is not the same as a cookie
The difference is not the word. It is what the browser does with the value without being asked. The web storage standard ties localStorage to a single website, and that is where this table comes from.
| A cookie | Storage on your own site | |
|---|---|---|
| Who can read it | The website, and other companies through third-party cookies | Only pages on your own website |
| What sends it | The browser, automatically, with every request | Nothing, unless your own page sends it |
| How long it lasts | Whatever the writer set | Until cleared, or until the script retires it |
The row that matters is the first one. A third-party cookie is written by a company other than the site you are on, and it goes back to that company from every site carrying its script. That is how a profile of someone gets built across the web. A code in your own site's storage cannot do that: only your website can read it, and it travels only where your own page sends it.
It is still storage on somebody's device, written so that you can count them. Keep that sentence in mind for the consent question at the end.
Where one customer becomes two visitors
Because the code belongs to one browser on one website, a journey splits in three ordinary places. Knowing them stops you misreading your own numbers.
A second website. The language school's course pages are on its own site, but enrolment happens on a booking platform at a different address. Two websites, two boxes of storage, two codes, one person. Left alone, the report says nobody who read the course page ever enrolled, which is a drop-off that is not real.
A link opened on another device. Somebody reads the newsletter on their phone, then books on a laptop that evening. The laptop has never seen the code, so it starts a fresh visitor with no newsletter attached.
A week of Safari without a visit. Since 2020, Apple's browser has deleted every kind of storage a website's script can write, localStorage included, after seven days of Safari use without interaction on the site. Somebody who reads your course page on a Tuesday and enrols the following Wednesday may be counted twice.
A cookie set by the same script breaks in exactly the same three places. Its reach is the same single website, and Safari caps the script-written kind on the same seven days. Cookies are not the fix. The fixes join the journey up deliberately: passing the code between your own websites, recognising a customer once they sign in, and counting the sale from the tool that took the money. Funnel Analytics does all three without a cookie.
What it can tell you about your marketing
For an owner deciding what to do next, cookie-less counting answers the useful question well: where did visitors come from, how far did they get, and how many got to the end.
Comparisons between sources stay fair. The three splitting problems above hit every source in much the same way. If the parents' group sends twice as many people to the enquiry form as the directory listing, that difference is real even when both totals run a little high.
Totals of people run a little high. One person on two devices is two visitors. Treat the number of people as an upper estimate, and lean on the comparisons rather than the absolute count.
Where people stop is visible. You can see whether the listing's visitors read one page and left, or got as far as the form and stopped there. Those are different problems with different fixes.
That is enough to make the Friday decision. If the directory listing sent visitors who never reached the enquiry form, and the parents' group sent fewer people who mostly did, the next piece of work goes into the parents' group. Knowing which marketing worked is how you decide what to try next. It is why Mole Marketer gives every initiative its own UTM tags (labels on the links, so each visit carries where it came from) and builds the next round of pitches with that in view.
What cookie-less tracking does not settle
Four limits, and a tool that hides them is selling you something.
- Cleared storage is a new visitor. Exactly as a cleared cookie would be
- Private browsing gets a code that lasts one page. The visit is counted and joins up with nothing else
- A sale recorded only in your payment tool is invisible until something sends it to your analytics. Counting a sale that happens in your payment tool explains how
- It does not decide whether you need a consent banner. That depends on where you operate and what you do with the data, and storage is storage, whatever it is called. Take this description of what the script stores to whoever advises you, and let them answer it
Frequently asked questions
What is cookie-less tracking?
It is counting website visitors without a cookie. The script keeps a random code in storage that belongs to your website alone, and sends it with each page view. Nothing about the person goes into the code, and no other website can read it.
How does a cookie-less tool know it is the same visitor?
It reads the code it stored in that browser on the last visit. If the code is gone, or the visitor is on a different device or browser, it does not know. It counts a new visitor rather than guessing, which is why totals of people run slightly high.
Is cookie-less tracking accurate enough to judge my marketing?
For comparing sources, yes. The places where journeys split affect every source in much the same way, so a difference between two sources is real. Totals of people run slightly high, so treat them as an upper estimate and decide on the comparisons.
Do I still need a consent banner if the tool does not use cookies?
That is not a question a vendor can answer for you. Your obligations depend on where you operate and what you do with the data, and keeping a code on somebody's device is still storage. Ask whoever advises you, and show them what the script stores.
How long does a cookie-less visitor code last?
In Funnel Analytics, until the visitor clears their browser data or goes about six months without a visit, whichever comes first. Safari is shorter in practice: a week of use without visiting your site removes it.
The trade, stated plainly
You give up recognising one person across every device they own without being told who they are. You get a code that describes nothing about anybody, a mechanism you can explain to a customer in two sentences, and comparisons you can act on.
For a small team the question was never "who exactly is this person". It was "which of the things we tried this month is worth doing again". Cookie-less counting answers that one well, as long as you read comparisons rather than totals and know the three places a journey splits.
Written by Oli
Founder of Mole Marketer. Writes about running marketing as a steady weekly process with a small team, and checks every third-party price against its own page before publishing.
