Cookieless analytics
Cookieless analytics: counting visitors without cookies.
Cookieless analytics counts visits without storing anything on the visitor’s device. Instead of a cookie, the server works out a short-lived, anonymous visitor ID from the request itself. ReplaStats works this way on any website, so there is no cookie to ask anyone about. Free for one site.
This page explains how the technology works. It isn’t legal advice.
How it works
How ReplaStats counts a visitor without a cookie
- The script stores nothing. It sets no cookies and writes nothing to the visitor’s browser. It is 4.7 KB and loads deferred.
- The server makes an anonymous ID. For each page view it hashes the IP address, the browser’s user agent and a salt that changes on a schedule, monthly in the default setting of the engine we run.
- Only the hash is kept. The IP address itself is not stored. The country, region and city looked up from it are.
- A visit ends after 30 minutes without activity, and the next page view starts a new one.
The honest part
What you give up without cookies
Long-term returning visitors
When the salt changes, the same person starts again as a new visitor. Returning-visitor figures cover the current period, not a year.
One person on two devices
A phone and a laptop are two visitors. Without a login, nothing links them.
Shared networks
Two people in one office, on the same network and the same browser version, can look like one visitor.
Ad audiences
There is nothing to build remarketing lists from. That is the point, but it rules out ad retargeting.
The rules
What the cookie rules actually say
Consent for cookies comes from Article 5(3) of the EU’s ePrivacy Directive. It covers storing or reading anything on the visitor’s device, not cookies by name:
“Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information […] This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.”
Directive 2002/58/EC, Article 5(3), as amended by Directive 2009/136/EC
France’s regulator, the CNIL, goes further and exempts some audience measurement from consent even when it uses trackers, if they are used only to measure the site’s own audience, produce anonymous statistics only, are not combined with other data or passed to third parties, and do not follow people across sites. GDPR still applies to any personal data the server handles, such as the IP address used to make the anonymous ID.
Compared
Cookieless analytics tools, side by side
| Tool | Cookies by default | Cheapest paid plan | Worth knowing |
|---|---|---|---|
| Plausible | None | $9 a month, 10,000 pageviews | Visitor ID changes daily; data in Germany |
| Fathom | None | $15 a month, 100,000 pageviews | No 10,000 tier; 7-day trial |
| Simple Analytics | None | $20 a month, 100,000 pageviews | Has a free plan; hosted in the Netherlands |
| Matomo Cloud | Yes, unless you switch them off | $26 a month, 50,000 hits | Cookieless is a setting |
| Independent Analytics | None | $49 a year (WordPress only) | Stores data in your WordPress database |
| Burst Statistics | Yes; cookieless is a setting | $49 a year (WordPress only) | Stores data in your WordPress database |
| Google Analytics 4 | Yes, _ga cookies | Free | Advanced consent mode sends cookieless pings when consent is refused |
| ReplaStats | None | $9 a month, no traffic limit | Free plan for one site; replays and heatmaps from $9 |
Questions people ask
Is cookieless analytics GDPR compliant?
Going cookieless removes the cookie question, which sits in the ePrivacy rules. GDPR still applies to any personal data the server processes, such as the IP address used to build the anonymous ID. ReplaStats doesn’t store IP addresses, but whether your setup complies is a question for your own adviser.
Do I need a cookie banner for ReplaStats?
Not for ReplaStats: it sets no cookies and stores nothing in the visitor’s browser. Other tools on your site that do set cookies may still need one.
How do cookieless tools count unique visitors?
They build an anonymous ID on the server from details of each request, such as the IP address and the browser, mixed with a salt that changes on a schedule. The engine ReplaStats runs on changes it monthly by default; Plausible changes it daily.
Is cookieless analytics less accurate?
In some ways it is more complete: it counts visitors who would refuse a consent banner, which cookie-based tools miss. It is less exact about returning visitors over long periods, and it counts one person on two devices as two.
Does Google Analytics have a cookieless mode?
Partly. In advanced consent mode, GA4 sends cookieless pings while a visitor has refused consent, and Google uses them for modelling. It still sets its cookies for visitors who agree.
Count every visitor. Store nothing on their device.
One line of code on any website, or the WordPress plugin. No traffic limits on any plan.
Sources: EUR-Lex (Directive 2002/58/EC), the CNIL’s guidance on audience measurement (July 2025, our translation), and each vendor’s own pages, checked on 2 October 2026. Also compared: Google Analytics · Plausible