Privacy and data
Privacy mode
Cookieless analytics in Stickybeak privacy mode uses no persistent IDs or goal properties and keeps location at country level. This privacy-friendly analytics option trades some reporting for data minimisation, not guaranteed legal compliance.
Turn on privacy analytics
Use either of these. They're equivalent:
<!-- Option 1: add data-privacy -->
<script
defer
data-site="YOUR_SITE_ID"
data-domain="example.com"
data-privacy="true"
src="https://app.usestickybeak.com/_cfw/s.js"
></script>
<!-- Option 2: load cookieless.js -->
<script
defer
data-site="YOUR_SITE_ID"
data-domain="example.com"
src="https://app.usestickybeak.com/_cfw/cookieless.js"
></script>cookieless.js always runs in privacy mode, even if the tag says data-privacy="false", so it's the safer choice when you want to be sure. If you serve the script first-party, use the same paths on your own domain.
Install only one Stickybeak tag per page. The first one to start decides the mode for that page.
What changes
| Standard | Privacy mode | |
|---|---|---|
| Visitor and session IDs | First-party cookies | Random IDs held in the page's memory only |
| Recognised after a reload or full page load | Yes | No. Route changes in a single-page app share the page's IDs. |
| Pageviews, named goals, live presence | Yes | Yes |
| Goal properties | Kept, after filtering | Dropped |
| Revenue | Recorded and attributed | Not recorded. purchase goals still count, without an amount or order ID. |
| Campaigns | UTM tags and affiliate codes | UTM tags only |
| Location | Country, region and city | Country only |
| Raw user agent and network name stored | Yes, for checking bot detection | No |
| Screen width sent | Yes, for device type | No |
| Permanent first-visit record | Yes | No |
| Raw data after 32 days | Archived | Deleted. Only daily totals remain. |
Browser, operating system, device type and country are still worked out and kept, and bots are still filtered. The cleaning of page addresses and referrers described in What Stickybeak collects applies in both modes. Like any web request, events still reach our servers with ordinary request details such as the IP address; privacy mode never uses them to recognise a visitor, by hashing or any other means.
The only thing privacy mode reads from the browser's storage is the stickybeak:ignore setting. As in standard mode, Do Not Track and Global Privacy Control don't stop the script; a visitor opts out with stickybeak:ignore.
What you give up
Without a lasting ID, a "visitor" in privacy mode is really one page load (plus any route changes in a single-page app). That means:
- Someone who reads three pages on a regular website counts as three visitors with three sessions.
- Every visitor looks new. There are no returning-visitor numbers.
- Journeys across pages, and the trail behind each order, aren't available.
- Sales aren't tied to amounts, so there's no revenue reporting or affiliate attribution.
Pageviews, top pages, referrers, campaigns, countries, devices and goal counts all still work.
Switching modes
Changing the tag changes how new visits are recorded. It doesn't rewrite anything already stored:
- Moving to privacy mode doesn't erase data or archives recorded in standard mode.
- Cookies left by the standard script are ignored, not deleted. They expire on their own (see Cookies), or you can remove them; see Consent and cookie banners.
For using privacy mode with a consent banner, see Consent and cookie banners.