Cookieless analytics that still counts sales
Load cookieless.js instead of the standard script and Stickybeak sets no cookies, stores nothing in the browser and keeps no IP addresses. Pages, sessions, places, goals and revenue are all still recorded.
Turn it on
<script defer data-site="YOUR_SITE_ID" data-domain="example.com"
src="https://app.usestickybeak.com/_cfw/cookieless.js"></script>It takes the same attributes as the standard script. There's no setting to change: the script on the page decides, and every hit says which script sent it.
How visitors are counted
Each visitor is a hash of the site, the IP address and the browser, keyed with a random salt that changes every day. The IP address and browser string are used for that hash and for bot checks, then dropped. Yesterday's salt is deleted an hour after midnight UTC, and after that nobody, including us, can work out who that day's visitors were or link them to another day.
Sessions still work, so pages per visit, bounce rate, time on site and same-day funnels are all there.
Standard or cookieless
| Standard | Cookieless | |
|---|---|---|
| Cookies and browser storage | Three first-party cookies | None |
| IP addresses stored | No | No |
| Country, region and city | Yes | Yes |
| Goals and revenue | Yes | Yes |
| Scroll depth | Yes | Yes |
| Returning visitors | Yes | No, visitors are counted per day |
| Attribution | First and last touch, 30 days | Same day |
| Query strings sent | Full address | Campaign tags and ?ref= codes only |
The full list is in privacy mode.
Do you need a cookie banner?
With the cookieless script, Stickybeak sets nothing on the visitor's device, so the ePrivacy and PECR rule about device storage isn't triggered, and it keeps no identifier that lasts beyond a day. Under typical EU and UK regulator guidance that's anonymous, aggregate analytics, which usually doesn't need consent.
This isn't legal advice: check your own situation, mention Stickybeak in your privacy policy, and keep personal data out of your URLs, campaign tags and goal properties, because those are recorded as sent.
Where it's stricter than most
- Salts deleted an hour after midnight UTC
- Only campaign tags and
?ref=codes kept from query strings - Referrers cut to their origin before they're sent
- No IP address kept, even for bots
Questions
Can I use both scripts?
Yes, on different pages. Every hit says which script sent it, so each visit is handled the way its script asks.
What do I lose?
Returning visitors and attribution across days. Someone who comes back tomorrow counts as a new visitor, and a sale is credited only to that day's visit.
Does Do Not Track stop it?
No. Neither script reads Do Not Track or Global Privacy Control. The cookieless script keeps no personal data, and nothing is sold or shared. Visitors can opt out with ?stickybeak=ignore.
Read more
- Privacy mode
Everything the cookieless script keeps and drops.
- Consent and cookie banners
Using Stickybeak with or without a banner.
- Privacy-friendly analytics
What privacy-friendly means, and how to choose.
- Google Analytics and GDPR
Where Google Analytics stands in the EU and UK.