Cookieless analytics: which tools count visitors without cookies, and how
Cookieless analytics counts your visitors without storing a cookie in their browser. Plausible, Fathom, Simple Analytics and Umami each say their tracker sets none, and Stickybeak has a cookieless privacy mode. They do it differently: three use a hash that resets every day, one reads the referrer. None of it is legal advice.
TL;DR
- Cookieless analytics counts visitors without storing a cookie or anything else in the browser.
- Plausible, Fathom and Stickybeak's privacy mode do it with a hash that changes every day. Simple Analytics uses the page's referrer. Umami says its tracker uses no cookies.
- The cost is accuracy about people over time: returning visitors and multi-visit attribution weaken or go away.
- "No cookie banner" is each vendor's claim about its own script, not a ruling for your site. Check your own regulator or ask a lawyer.
Stickybeak is live analytics for every site you own, set up with one script tag. Its privacy mode is the cookieless script. It is in early access, with a free plan and paid plans from US$20 a month.
Get early accessWhat cookieless analytics means
A normal analytics script stores a random ID in a cookie, then reads it back on the next visit so it knows the same person returned. A cookieless one stores nothing, so it has to work out who is new from the request itself. The two common ways are a hash of request details that changes every day, and the page's referrer.
Two things are easy to mix up. Cookieless is about what is stored on the visitor's device. Privacy-friendly is wider: it also covers what is collected and where it lives, which our privacy-friendly analytics guide goes through.
How five tools do it
Each row is that vendor's description of its own script. Stickybeak is our product.
| Tool | Cookies | How it tells visitors apart | What it says about banners |
|---|---|---|---|
| Plausible | "We do not use cookies, browser cache or local storage." | A hash of a daily salt, the site domain, the IP address and the user agent. The salt is rotated and deleted every 24 hours. Raw IP addresses and user agents are not stored. | Says you do not need cookie banners for analytics. |
| Fathom | Counts visitors "without setting analytics cookies". | A SHA-256 hash of the IP value, user agent, site ID and a daily salt that rotates at midnight UTC. | Describes its analytics as having no consent banner for analytics. |
| Simple Analytics | "We do NOT set any cookies (or use similar technologies)." | Does not use IP addresses for this. A visit is unique based on the hostname of the page's referrer. Country comes from the visitor's time zone. | "You don't need an opt-in for our service." |
| Umami | "Umami's web tracker does not use cookies." | Its FAQ does not say how visitors are told apart; see its metric definitions. | "Whether your website needs a cookie notice depends on the other services you use and applicable requirements." |
| Stickybeak (ours) | Privacy mode sets none and stores nothing in the browser. The standard script sets three first-party cookies. | A daily-salted hash of site, IP and user agent. The salt is deleted an hour after midnight UTC. No IPs or user agents are stored. | See consent and cookie banners for setup options; check your own legal requirements. |
Read the differences, not just the ticks. Plausible, Fathom and Stickybeak all hash, so none can follow a person from one day to the next. Simple Analytics avoids the IP address altogether, which makes its unique-visitor count a different thing: it is a count of visits that arrived from elsewhere. Fathom's own page adds that signatures are stored with event records and are not erased when the salt changes, and that a reporting day spanning two UTC salts can affect unique counts.
What you give up without cookies
- Returning visitors. With a daily hash, the same person is a new visitor tomorrow. Counts are visitors per day.
- Attribution across visits. With anonymous daily-hash or referrer-based counting, a sale that comes a week after the first click can't be tied back to it. Umami's optional Distinct IDs instead link sessions to an identifier you supply, such as a user ID. In Stickybeak's privacy mode, attribution is same-day only and affiliate credit across visits doesn't work.
- Accuracy on unique counts. Visitors sharing an IP address and browser can merge, and one person on two devices counts twice.
What stays: page views, top pages, referrers, countries, devices and goals. Stickybeak's privacy mode also keeps revenue. If you need journeys across visits and don't supply your own identifier, use the standard script and, where the law asks for it, get consent first.
Does cookieless mean no cookie banner?
Not automatically. A vendor saying "no banner needed" is describing its own script. Your site can still need consent for other things on the page: a chat widget, an ad pixel, an embedded video. Rules also differ by country, and regulators have set their own conditions for exempting audience measurement. Umami's FAQ puts it plainly: whether a notice is needed depends on the other services you use and the requirements that apply. The same FAQ says GDPR compliance depends on how you configure and use it.
A practical way to decide: list every script and cookie on your site, remove what you don't need, then check your own regulator's guidance or ask a lawyer. This is not legal advice, and Stickybeak makes no claim that any setup is compliant. Our Google Analytics and GDPR guide covers the other side of that choice.
Choosing a cookieless tool
- You want a simple, privacy-first traffic dashboard: Plausible, Fathom and Simple Analytics are built for exactly that. Our Plausible pricing guide has their prices side by side.
- You want to run it yourself: Umami's docs cover how to set it up on your own server or use its cloud; read them before you pick.
- You run several sites and sell something: Stickybeak shows every site on one live screen with revenue by channel. Use privacy mode where you want no cookies, and the standard script where you want returning visitors. See the cookieless analytics feature and the best website analytics tools comparison.
Questions
What is cookieless analytics?
Cookieless analytics counts visits to a website without storing a cookie in the visitor's browser. Instead of reading an ID back from the browser, the tool works out who is new from data in the request itself, such as a daily hash of the IP address and user agent, or from the referrer. It is also called analytics without cookies or cookieless tracking.
Which analytics tools are cookieless?
Plausible, Fathom, Simple Analytics and Umami each say their tracker sets no cookies, and Stickybeak has a cookieless privacy mode. Stickybeak's standard script is not cookieless: it sets three first-party cookies.
How do cookieless tools tell visitors apart?
Plausible and Fathom describe a hash of a daily salt, the site, the IP address and the user agent, with the salt rotated every day. Stickybeak's privacy mode uses a daily-salted hash of site, IP and user agent too. Simple Analytics says it decides whether a visit is unique from the hostname of the referrer and does not use IP addresses.
Do I need a cookie banner with cookieless analytics?
Several vendors say you do not need one for their analytics, but that is a claim about their script, not a legal ruling about your site. Other scripts, embeds and your country's rules still apply. Umami, for example, says whether you need a cookie notice depends on the other services you use. This is not legal advice.
Is cookieless analytics less accurate?
For counting visits, pages and sources it works well. For people over time it is weaker: with a daily hash the same person is a new visitor each day, so returning visitors and attribution across visits are lost or reduced unless you supply your own identifier. Fathom's own documentation notes the hash is not designed to follow a visitor long term.
Is cookieless the same as GDPR compliant?
No. Cookieless describes what is stored in the browser. Compliance depends on what is collected and how you use it. Umami says GDPR compliance depends on how you configure and use it. No tool on this page can make a site compliant on its own.
Does Stickybeak have a cookieless mode?
Yes. Privacy mode loads cookieless.js instead of s.js. It sets no cookies, stores nothing in the browser and keeps no IP addresses, and still records pages, goals and revenue. Visitors are counted per day, so returning visitors and affiliate credit across visits do not work in this mode.
Sources, checked 6 November 2026: Plausible, data policy; Fathom, data page; Simple Analytics, what we collect; Umami, FAQ and Distinct IDs. Stickybeak facts come from its privacy mode documentation. Vendors change their products; if this page is out of date, tell us and we will fix it.