How Cookieless Analytics Actually Works

"Cookieless analytics" gets said a lot and explained rarely, which makes it sound like either magic or marketing. It is neither. Here is what the cookie was actually doing, what takes over when you remove it, and which of your numbers get less certain as a result.

What the cookie was for

Almost nothing in analytics needs a cookie. A pageview does not: the request itself tells you the URL, the referrer, the rough location and the user agent. You can count pageviews forever without storing anything on anyone's device.

The cookie exists for one job: recognising the same browser again later. That underpins two things.

The first is stitching a visit together. Someone lands on your pricing page, reads for a minute, then clicks through to your docs. Is that one visit of two pages, or two visits of one page each? With an identifier you know. Without one, you have to work it out.

The second is recognising someone across days. Google Analytics' _ga cookie lasts two years, which is how it tells you a visitor is "returning". That is also the part that makes it personal data in the EU, and the reason your site has a banner.

What replaces it

Galytics computes a signature: an HMAC-SHA256 of the visitor's IP address and user agent, keyed with a secret that only our server holds. That signature is stored on the session row. The raw IP address is not stored anywhere, and there is no column for it.

When the next event arrives, we look for a session on the same site with the same signature whose last activity was within the previous 30 minutes. If there is one, the event joins it. If not, a new session begins.

Two things follow from that design. Because the hash is keyed with a server-side secret, nobody who obtains the data can turn it back into an address. And because the stitching window is 30 minutes, it is not being used to follow anyone from one day to the next.

Be clear about what this is, though: a signature is a pseudonymous identifier. It is not "no identifier at all". The honest claim is that nothing is stored on the visitor's device, no address is retained, and the identifier is not reversible. That is what removes the need for a banner. It is not the same as claiming the data is anonymous in every sense a lawyer might mean.

For location, the country arrives from the network edge, which already knows it. There is no lookup against a database of addresses.

What you actually lose

This is the part most cookieless tools skate over, so plainly:

Unique visitors is an approximation. It is a count of distinct signatures in the period. Since a signature is an address plus a browser, it over-counts anyone whose address changes, which on a mobile network can happen several times a day, and under-counts an office or a household where several people share an address and a browser version. Over a week it is close enough to steer by. Over 90 days it is an estimate, and any tool that tells you otherwise without a device identifier is claiming more precision than it has.

Multi-device journeys are gone. Someone who browses on a phone and buys on a laptop is two visitors. With a cookie they were usually two visitors anyway, since cookies do not travel between devices either. Smaller loss than it sounds.

Long attribution windows get unreliable. If your sales cycle runs for months and you need to tie a purchase to an ad someone saw in June, cookieless measurement will not do it. Know that before you switch.

What you keep

Everything most sites actually act on. How many people came and from where. Which pages hold attention and which lose it. Whether the conversion rate moved after you changed the headline. What people did in the session before they gave up, if you have replay.

And you keep the visitors who would have refused. That is the part people underestimate. When measurement sits behind a consent banner, everyone who declines is missing, and they are not a random sample. They skew towards more technical, more privacy-conscious, more ad-blocking. If those people matter to your business, a consented dataset is systematically the wrong dataset.

Is it accurate?

More accurate than the thing it replaced, for most sites, which surprises people.

A consented cookie dataset is precise about a subset. A cookieless dataset is approximate about everybody. If a quarter of your visitors decline the banner, you are choosing between exact numbers for 75% of your traffic and slightly fuzzy numbers for all of it. For deciding whether a page works, the second is more useful.

The trade you are making

Cookieless is the right default if you want no banner, you care about EU data residency, and your questions are about pages and campaigns rather than individuals over long periods.

It is the wrong default if you need user-level product analytics, month-long attribution windows or retargeting. Those genuinely need an identifier, and no amount of clever engineering gets around it.

We wrote up the specific case against the most common alternative in Galytics vs Google Analytics, including what Google's own documentation says its analytics cookies are for.