This guide explains how cookieless tracking works, what website analytics without cookies can measure, what EU consent rules say, and how Google Analytics 4 handles visitors who decline cookies. You'll also learn how to decide what your site needs.

We’ll also consider the legal question. Going cookieless changes what is stored on a visitor's device, but it doesn't automatically settle whether you need consent. This article is for informational purposes only and does not constitute legal advice. For guidance specific to your organization, consult a qualified legal professional.

What cookieless analytics is

Traditional website analytics uses cookies to recognize visitors. When someone visits your website, the analytics tool stores a unique identifier in their browser. It reads that ID on subsequent visits, allowing it to recognize the same browser for weeks or months.

Cookieless web analytics takes a different approach. Also called cookie-free analytics or cookieless website analytics, it counts visits independently or uses a temporary ID that expires quickly. This allows web analytics without cookies, although the reporting has limitations.

You'll often see the cookies used by traditional analytics described as "analytics" or "performance" cookies on consent banners. For more background on how websites collect visitor data, see our guide to web analytics.

Why teams look at cookieless analytics

Declined consent leaves gaps in your data

When someone declines analytics cookies, a cookie-based setup collects less information about their visit. It leaves gaps in your reports, which can show fewer visits than actually happened. That's the main reason marketers look at cookieless analytics. For example, if you've just run a campaign and want to measure the traffic it generated, your reports may only show part of the picture if some visitors declined analytics cookies.

To see how much this affects your numbers, check your analytics consent acceptance rate in your consent tool, counted as the share of visitors shown the banner who accepted analytics cookies. Record it alongside your traffic figures so your team can see the potential measurement gap.

For a second check, compare a count that doesn't depend on cookies, such as form submissions recorded in your CRM, with the same count in your analytics over the same days. The difference shows how much your reports are missing. This is one of the web analytics best practices covered in our guide.

Chrome has not removed third-party cookies

You may have read that Chrome is getting rid of third-party cookies, but that is not the case. In its April 22, 2025 announcement, Google confirmed that Chrome will continue to let users choose how third-party cookies work in their browser settings. It also confirmed there would be no new standalone prompt for third-party cookies. Chrome's Incognito mode already blocks third-party cookies by default. Then, on October 17, 2025, Google announced plans to retire most Privacy Sandbox technologies, including Topics and the Attribution Reporting API. These browser decisions are separate from EU consent rules, which address storing or accessing information on a visitor's device, regardless of who sets the cookie. For more on Google's changing plans and the so-called cookieless future, see our guide to web analytics trends.

How cookieless tracking works

Every analytics tool needs a way to determine whether two page views came from the same browser. Cookieless web tracking uses methods that avoid storing a lasting identifier on the visitor's device. Depending on the method, analytics without cookies can recognize activity for a short period or count each page view separately, with no way to link them.

When no identifier is used, you can still measure traffic and referral sources, but the system cannot tell whether different page views came from the same visitor.

Short-lived server-side identifiers work differently. The server uses a process called hashing, which scrambles details such as an IP address and browser type into a code that does not show the original details. It adds a random value called a salt before hashing. By changing that salt daily, the server prevents yesterday's codes from being matched to today's.

An identifier held in page memory lasts only while the page or tab remains open. Once the visitor closes it, the identifier disappears. This allows the system to connect activity during that period without retaining an identifier for later visits.

With cookieless server-side tracking, requests pass through a server you control before selected information is forwarded elsewhere. You decide what the server retains and forwards, although this does not settle whether consent is needed.

Some tools combine methods, using cookieless counting until a visitor consents and cookies afterward, although the cookieless stage still raises the consent question we'll examine below. Google Analytics 4's advanced consent mode takes a similar approach, which we’ll explain later.

Fingerprinting works differently. It creates a lasting identifier from device characteristics that a script reads, such as screen size and installed fonts. This allows long-term recognition, and visitors cannot clear the identifier as they would a cookie. Fingerprinting therefore falls outside our definition of cookieless analytics. The European Data Protection Board's guidelines adopted on October 7, 2024 explain that collecting identifiers through tracking scripts can constitute a "gaining of access" to information on a device under Article 5(3) of the ePrivacy Directive, which also covers cookies.

What you give up without a cookie

Cookieless user tracking has limitations, particularly when you need to understand how visitors behave over time.

Losing information about returning visitors is a significant drawback. Without a lasting identifier, your analytics cannot reliably distinguish new visitors from returning ones. Someone who visits your website several times may appear as several different people, inflating your unique visitor count and making it harder to understand how often they return.

You also lose the ability to follow visits across different days. For example, if someone visits your product page on Monday, then comes back to check your pricing on Thursday, with cookieless analytics, these appear as two unrelated visits. This includes any funnels that depend on connecting those visits.

Attribution windows are another loss. If someone clicks a campaign link today and requests a demo ten days later, your analytics cannot reliably credit the original campaign for that conversion without an identifier connecting those visits. Campaign tags, such as utm parameters, still work on the landing visit. For a closer look at this issue, see our guide to B2B marketing attribution.

However, you can still measure many valuable data points. Cookieless analytics can record page views, your most popular pages, entry pages, referrers, and campaign tags on the landing visit. It can also collect information such as country and device type, plus actions within a single visit, such as form submissions.

These limitations matter especially in B2B, where buyers may visit a supplier's website repeatedly over several weeks before making contact, compared with an online shop where purchases often happen in a single visit. Some teams therefore consider counting visits without cookies and setting cookies only for visitors who consent, although whether the cookieless measurement itself requires consent is a separate question we'll examine next.

Cookieless does not mean consent-free

This section provides general information, not legal advice. EU countries apply different rules, so the site owner should decide with their data protection officer (DPO), who advises on privacy law, or legal counsel.

Two questions, two sets of rules

When assessing cookieless web analytics and GDPR, it's easy to confuse which rules apply. Questions about analytics without consent under GDPR can also involve the EU's ePrivacy Directive, which governs a separate issue.

Article 5(3) of the ePrivacy Directive covers storing information on a visitor's device or accessing information already stored there, as explained in the European Data Protection Board's October 7, 2024 guidelines. GDPR governs how organizations process personal data, including the legal basis for processing it, how long they retain it, and who receives it.

Cookieless analytics usually still processes IP addresses. In Breyer (C-582/14), the Court of Justice of the European Union ruled on October 19, 2016, that a dynamic IP address can constitute personal data for a website operator that has legal means to identify the visitor using additional information held by the visitor's internet access provider. The distinction between cookieless tracking and GDPR is important because removing cookies may change the ePrivacy assessment, while GDPR still requires a legal basis for processing personal data. The site owner should determine that basis with their DPO or legal counsel.

The rule covers more than cookies

The European Data Protection Board (EDPB), the body of EU data protection regulators, addressed newer tracking techniques in its Guidelines 2/2023, Version 2.0, adopted October 7, 2024. The guidelines clarify how Article 5(3) applies beyond traditional cookies, including tracking pixels, tracking links, scripts, unique identifiers, and techniques based solely on IP addresses.

The EDPB explains that the rule covers personal and non-personal information, "regardless of how this data was stored and by whom". When a tracking script collects identifiers from a visitor's device, the EDPB considers this a "gaining of access" to information under Article 5(3). Removing cookies therefore doesn't necessarily remove the activities that bring an analytics setup within the rule's scope.

IP-based tracking requires particular care. According to the EDPB's October 2024 guidelines, Article 5(3) can apply to IP addresses when they originate from the visitor's device, which the EDPB says "is not systematically the case", but it treats IPv6 addresses and static IPv4 addresses originating from a visitor's router as falling within the rule.

The guidelines address which technical activities fall within Article 5(3). They leave exemptions to be assessed case by case under each country's laws and national regulator guidance. The EDPB also notes that the rule applying "does not systematically mean that consent needs to be collected".

The narrow exemption for audience measurement

Some national regulators describe a narrow exemption from consent for audience measurement. France's data protection regulator, the CNIL, explains the conditions in its guidance, Cookies : solutions pour les outils de mesure d'audience, published July 4, 2025. In the CNIL's view, audience measurement that meets strict conditions can be treated as strictly necessary, so it can be carried out without consent. 

Among the conditions the CNIL sets out, it limits how website owners can use the information they collect:

"être utilisés pour une finalité strictement limitée à la seule mesure de l’audience du site ou de l’application (...), pour le compte exclusif de l’éditeur ; servir à produire des données statistiques anonymes uniquement."

Our translation: [The trackers must be] used only to measure the audience of the site or app, solely on behalf of the publisher, and only to produce anonymous statistics.

The CNIL also restricts how that information can be combined and shared:

"ne doivent pas : conduire à un recoupement des données avec d’autres traitements ou à ce que les données non anonymes soient transmises à des tiers ; permettre le suivi global de la navigation de la personne utilisant différentes applications ou naviguant sur différents sites web."

Our translation: They must not lead to data being combined with other processing or non-anonymous data being passed to third parties, or allow people to be tracked across different apps or websites.

The CNIL's guidance also recommends limits on how long information is retained:

"la durée de vie des traceurs soit limitée à une durée permettant une comparaison pertinente des audiences dans le temps, comme c’est le cas d’une durée de treize mois, et qu’elle ne soit pas prorogée automatiquement lors des nouvelles visites ; les informations collectées par l’intermédiaire de ces traceurs soient conservées pour une durée maximale de vingt-cinq mois."

Our translation: The tracker's lifetime is limited to a period that allows meaningful audience comparisons over time, such as 13 months, without automatic extension on new visits. The information collected is kept for 25 months at most.

The CNIL's July 2025 guidance also asks website owners to consider whether their analytics provider transfers data outside the EU.

The CNIL's conditions are not limited to cookieless tools. In its guidance, they can cover trackers, including cookies, that meet them. These conditions reflect France's position under French law. Other EU countries apply the rule through their own laws and publish their own regulatory guidance. The site owner and their DPO or legal counsel should assess whether a particular setup meets the applicable conditions.

Questions to take to your DPO or legal counsel

Before changing your analytics setup, document what each script collects and how your website handles that information. Take these questions to your DPO or legal counsel for review.

1. What does each analytics script store on the device, and what does it read from it?

2. What does each request send, including IP addresses, browser details, page addresses, and referrers?

3. Who receives the data, and is any of it processed outside the EU?

4. Is the data used only to measure our own site's audience, or is it combined with anything else?

5. How long is the data kept, and how long does any identifier last?

6. Do we record whether each visitor consented, so we can report the measurement gap?

The same questions apply to session-recording scripts and the tools covered in our guide to website heatmap analytics.

Google Consent Mode: basic and advanced

Google describes Consent Mode as a way to adjust how its tags behave based on visitors' consent choices. This affects how Google Analytics 4 (GA4) collects data when visitors accept or decline cookies.

Consent Mode uses four consent signals. analytics_storage controls analytics-related storage, while ad_storage controls advertising-related storage. Consent Mode v2 added ad_user_data, which communicates consent to send user data to Google for advertising, and ad_personalization, which communicates consent for personalized advertising.

Google's EEA consent guidance states that "you must collect consent for use of personal data from end users based in the EEA and share consent signals with Google for these use cases." This is Google's policy for its tools, separate from the legal requirements discussed above.

Google offers basic and advanced implementations of Consent Mode, with significant differences in what happens when visitors decline consent.

Under advanced mode, Google receives information before a visitor grants consent and when consent is denied. Its technical documentation explains that requests can still contain the full page URL, including advertising click parameters, when ad_storage is denied. Whether that collection is permitted on a particular website requires the legal assessment described above.

For more on the wider tool, see our guide to google analytics 4. For installation instructions, see monitor website traffic.

Behavioral modeling and its thresholds

According to Google Analytics Help, behavioral modeling uses machine learning to estimate the behavior of visitors who decline analytics cookies, based on the behavior of similar visitors who accept them.

However, Google sets strict eligibility requirements for behavioral modeling. First, your website must use advanced Consent Mode, with Google tags loading regardless of whether visitors grant consent. The GA4 property must also collect at least 1,000 events per day with analytics_storage set to 'denied' for at least seven days. Google also requires at least 1,000 daily users sending events with analytics_storage set to 'granted' on at least seven of the previous 28 days. This requirement is particularly important when assessing whether cookieless tracking in GA4 can produce modeled data.

Even then, Google warns that meeting these conditions "doesn't guarantee eligibility". Its modeling system considers other factors, including the ratio of new to returning users. Before relying on modeled reporting in Google Analytics 4 without cookies, compare your property's daily consent-granted users with Google's 1,000-user threshold. Modeled data only appears when the property's reporting identity is set to Blended, so check that setting in GA4's admin, and check which identity any export or dashboard uses before you compare numbers.

How to decide what your site needs

Once you've identified what you need to measure, you can decide how to implement cookieless tracking on your website.

1. Define your reporting questions.

Write down what your team needs to know about website performance and campaign results. Focus on the figures you regularly use to make decisions.

2. Audit your existing scripts

List what each script stores on visitors' devices, what it reads, and what information it sends. Use Google Tag Manager if you have it installed, alongside your browser's developer tools: open your site in a private window, decline the consent banner, then look at which requests still go out and which cookies or local storage entries appear. Repeat after accepting.

3. Match the data to your requirements

For each reporting question, identify the minimum information needed to answer it. Check which questions cookieless counting can answer and which require an identifier that lasts longer.

4. Get legal approval

Take your proposed setup and the questions from the consent section to your DPO or legal counsel. Have them review the configuration before you make any changes.

5. Compare your reports

If you change your setup, run the existing and proposed configurations side by side for a few weeks, within the consent arrangements your DPO has approved. Compare the figures to understand how the change affects your reporting. Compare page views and entry pages on the same days and pages. Don't compare visitor counts, because a cookieless setup counts one person who returns as several.

For help choosing an analytics tool, see our guide to privacy-friendly analytics. If your website runs on WordPress, where plugins often handle analytics, see our guide to wordpress website analytics.