Skip to main content

Cookieless Analytics: Complete Guide 2026

· 20 min read
Rafael Jimenez
Rafael Jimenez
Founder & CEO at Sealmetrics

TL;DR — Cookieless analytics measures every visit without consent banners, closing the 15-60% gap cookie tools lose. Guide to implementation, GDPR, and comparisons.

Last Updated: March 10, 2026

Introduction​

Cookieless analytics has emerged as the solution to this data loss crisis. Unlike traditional cookie-based platforms like Google Analytics — which surrender 15-60% of their data to banner ghosting and rejection — cookieless analytics measures every visit without consent banners, cookies, or personal identifiers like IP addresses.

This complete guide explains how cookieless analytics works, why it's GDPR compliant without consent, and how platforms like Sealmetrics provide businesses with accurate, complete data while respecting user privacy.

Key Takeaways​

  • Cookieless analytics measures every visit without cookie consent banners, closing a 15-60% gap
  • No legal basis is required at all when no personal data is stored: the dataset falls outside the GDPR's material scope (Recital 26), and ePrivacy Article 5(3) is never triggered because nothing is written to the device
  • Session-based tracking replaces cookies with temporary identifiers that reset after each visit
  • Sealmetrics provides true cookieless analytics without storing IP addresses (unlike competitors)

What is Cookieless Analytics?​

Cookieless analytics is a web analytics methodology that tracks website visitors and their behavior without using cookies or requiring user consent. Instead of placing tracking cookies in users' browsers, cookieless analytics platforms use alternative identification methods that don't qualify as "cookies" under the ePrivacy Directive Article 5(3).

The core principle of cookieless analytics is session-based tracking. Rather than identifying returning visitors across multiple sessions (which requires cookies), cookieless analytics treats each visit as an independent session with a temporary identifier that expires when the user closes their browser or after a period of inactivity.

Why Cookieless Analytics Matters in 2026​

Traditional cookie-based analytics faces three critical challenges:

  1. Massive data loss: cookie rejection rates run from around 40% in the US to 87% in Germany, translating into 15-60% of your data never reaching your reports
  2. Legal complexity: Cookie consent requirements under GDPR and ePrivacy create compliance burdens
  3. Poor user experience: Consent banners frustrate users and increase bounce rates by 10-15%

Cookieless analytics solves all three problems by eliminating cookies entirely from the tracking process.

To understand why cookieless analytics is necessary, we must first understand how traditional analytics fails.

Under the ePrivacy Directive Article 5(3), websites must obtain explicit user consent before placing tracking cookies. This means:

  • Users see a consent banner before any tracking begins
  • Many reject it, and more ignore it entirely — ghosting is usually the larger group
  • Both become invisible to your analytics
  • Your data represents 40-85% of actual traffic, depending on your sector, brand strength and traffic sources

One caution: a rejection rate is not a data loss rate. Rejection is measured among the people who engaged with the banner, and Consent Mode v2 models some of the unconsented traffic back in as estimates. Net of that, Google Analytics 4, Matomo in default mode, and most traditional analytics tools lose 15-60% of EU traffic data because they rely on cookies that users decline or ignore.

Real-World Impact: E-commerce Example​

Consider an online store with 10,000 monthly visitors in Germany — a privacy-sensitive market, so assume it sits toward the harder end of the range:

With cookie-based analytics (GA4):

  • Consent banner shown: 10,000 users
  • Measured users: ~4,500 (45% capture rate)
  • Invisible users: ~5,500 (55% data loss)

With cookieless analytics (Sealmetrics):

  • No consent banner required
  • Measured users: 10,000
  • Invisible users: none beyond the JavaScript blockers no tool can see

The business with cookieless analytics has more than twice the data to make decisions with. And the volume is the lesser half of the benefit: the 5,500 missing visitors were not a random sample, so their absence doesn't merely shrink the numbers, it bends them.

How Cookieless Analytics Works: Technical Deep Dive​

Cookieless analytics platforms use several technical approaches to track visitors without cookies. The most privacy-respecting method is session-based tracking with temporary identifiers.

Session-Based Tracking Methodology​

Sealmetrics uses a dual-system approach that provides complete data without requiring consent:

System 1: Session ID Tracking​

For users with JavaScript enabled (95%+ of visitors):

  1. Visitor arrives at your website
  2. Temporary session ID generated in browser memory (not stored as cookie)
  3. Events tracked with this session ID throughout the visit
  4. Session expires when browser closes or after ~2 hours of inactivity
  5. New session ID generated on next visit (user is not tracked across visits)

Key point: The session ID exists only in browser memory during the active session. It never persists as a cookie, so it doesn't require consent under ePrivacy Article 5(3).

System 2: Isolated Hits Tracking​

For users without JavaScript or with ad blockers (5% of visitors):

  1. Each pageview tracked independently without any identifier
  2. No cross-page session tracking (cannot connect pages to same visit)
  3. Aggregated statistics only (pageviews, referrers, devices)

This dual approach keeps Sealmetrics measuring regardless of browser configuration — there is no consent gate for any of it to fail at.

What Makes Tracking "Cookieless"?​

According to CNIL's 2020 guidance on analytics, tracking is considered cookieless if:

  1. No persistent identifiers stored in the browser
  2. No cross-session tracking of individual users
  3. No combination with other data to re-identify users
  4. Limited data retention (CNIL sets a 25-month ceiling; Sealmetrics applies a stricter 24 months)

Sealmetrics meets all four criteria:

  • Session IDs exist only during active sessions
  • Users cannot be tracked across visits
  • No IP addresses stored (unlike Plausible/Matomo which hash IPs)
  • Aggregates retained 24 months, documented and inside the CNIL ceiling

The most common question about cookieless analytics: "If you're tracking users, doesn't that require consent under GDPR?"

Answer: No, if properly implemented.

The Prior Question: Is There Personal Data at All?​

Most vendors answer the consent question by naming a legal basis — usually Article 6(1)(f), legitimate interest. That is the wrong move for a genuinely cookieless tool, because naming any Article 6 basis concedes that you are processing personal data and are merely entitled to. It hands away the argument you were trying to win.

GDPR Recital 26 puts it directly: the principles of data protection do not apply to anonymous information — information which does not relate to an identified or identifiable natural person. If your analytics stores no IP address (hashed or otherwise), no user ID and no cross-session identifier, the dataset falls outside the material scope of the Regulation. Article 6 is never reached, because there is no personal data for it to govern.

So the honest answer isn't "we have a good legal basis." It's:

  1. Nothing stored identifies a person: no IPs, no persistent identifiers, no cross-session correlation
  2. Nothing is written to or read from the device: so ePrivacy Article 5(3), the rule that actually mandates banners, is never triggered
  3. Therefore no Article 6 basis is required, and no consent record needs to exist

The one place Article 6(1)(f) does correctly apply is much narrower: the transient, in-memory handling of an IP for security and anti-abuse checks, which Recital 49 addresses. That IP is never written to storage and never reaches the analytics dataset.

CNIL Guidance on Cookieless Analytics​

In July 2020, CNIL (the French data protection authority) published guidance explicitly allowing certain analytics methods without consent:

"Audience measurement tools that are used to obtain statistics on the use of a website or mobile application can be exempted from consent if they meet certain conditions."

These conditions include:

  • Use exclusively for statistical purposes
  • No cross-site tracking
  • No combination with other processing
  • Limited data retention (25-month ceiling; tracker lifetime capped at 13 months)
  • IP address not stored or anonymized

Sealmetrics meets all CNIL requirements by design. Unlike Plausible and Matomo (which hash and store IP addresses), Sealmetrics never stores IP addresses at all. Worth being precise: CNIL publishes criteria, it does not certify or approve individual analytics tools — no supervisory authority does. What follows is our own assessment against those criteria, not a regulatory endorsement.

The ePrivacy Directive Exception​

The ePrivacy Directive Article 5(3) requires consent for cookies. However, it includes an exception:

"The storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information, and is provided with the right to refuse such storage or access."

Cookieless analytics doesn't trigger this requirement because:

  1. Session IDs stored only in memory (not persistent storage)
  2. IDs expire when browser closes
  3. No information "stored" in the traditional sense

This is why Sealmetrics requires no consent banner while cookie-based tools do.

FeatureGoogle Analytics 4Plausible AnalyticsMatomoSimple AnalyticsSealmetrics
Requires CookiesYesNoNo (cookieless mode)NoNo
Requires Consent BannerYesDepends on configDepends on configNoNo
Stores IP AddressesYes (full)Yes (hashed)Yes (hashed)Yes (hashed)Never
Consent-driven data loss15-60%Lower, non-zero where consent appliesLower, non-zero where consent appliesNoneNone
Cross-Session TrackingYesNoYes (with consent)NoNo
GDPR Legal BasisConsent requiredLegitimate interestConsent or LILegitimate interestNone required — no personal data (Recital 26)
CNIL CompliantNoPartialPartialYesYes
Setup ComplexityHigh (30-60 min)Medium (10 min)High (20-30 min)Low (5 min)Very Low (2 min)
Data Retention14 monthsUnlimitedUnlimitedUnlimited24 months
Real-Time DataDelayedYesYesYesYes
Price (10k pageviews/mo)Free (but data loss)$9/mo$29/mo$19/mo$49/mo
Consentless AnalyticsNoNoNoNoYes

Key Insight: Not All "Cookieless" is Equal​

Many analytics tools claim to be "cookieless" or "privacy-first," but still:

  • Hash and store IP addresses (Plausible, Matomo, Simple Analytics)
  • Use localStorage instead of cookies (technically still requires consent)
  • Implement fingerprinting (clearly violates GDPR)

Sealmetrics is the only major platform that provides true consentless analytics by:

  1. Never storing IP addresses at all (not even hashed)
  2. Using only session-based tracking (no persistent identifiers)
  3. Meeting all CNIL requirements without configuration changes

Benefits of Cookieless Analytics​

1. Complete Data Capture​

The biggest advantage: you see all your visitors, not just the 40-85% a consent banner lets through — and not a self-selected 40-85% at that.

Business impact:

  • More accurate conversion rates
  • Better understanding of user journeys
  • Improved marketing attribution
  • No blind spots in your data

User experience improvement:

  • No annoying pop-ups
  • Faster page loads (no consent management script)
  • Lower bounce rates (10-15% decrease when removing banners)
  • Better mobile experience

Legal simplification:

  • No consent management platform needed ($0-500/month saved)
  • Simpler privacy policy
  • Easier DPO approval process
  • Lower legal risk

3. GDPR Compliant by Default​

Automatic compliance:

  • No Article 6 legal basis required: no personal data stored (Recital 26)
  • ePrivacy Article 5(3) not triggered: nothing written to or read from the device
  • Meets CNIL cookieless exemption criteria
  • Data minimization principle satisfied
  • No cross-border data transfer issues (if EU-hosted)

4. Better Performance​

Technical advantages:

  • Smaller tracking script (Sealmetrics: 2.1 KB vs GA4: 45 KB)
  • No third-party cookies blocking
  • Works with ad blockers (partially)
  • Faster page load times

How to Choose a Cookieless Analytics Platform​

When evaluating cookieless analytics tools, ask these questions:

Red flag: If the provider says "cookieless but you should still show a banner to be safe," it's not truly compliant.

Sealmetrics answer: No consent banner required. Period.

Question 2: Does it store IP addresses?​

Red flag: Hashing IPs doesn't make them anonymous under GDPR (per Breyer vs Germany ECJ ruling).

Sealmetrics answer: We never store, hash, or process IP addresses. Ever.

Question 3: What's the data retention period?​

CNIL recommendation: 13 months maximum for cookieless analytics.

Sealmetrics approach: 24 months on aggregates, documented and available to customers, inside CNIL's 25-month ceiling.

Question 4: Can you track across sessions?​

The rule: cross-session tracking needs a persistent identifier, which puts you squarely back inside ePrivacy Article 5(3) and the GDPR.

Sealmetrics approach: We don't track users across sessions. Each visit is independent.

Question 5: What's the data processing location?​

GDPR concern: Transfers to US or other third countries require additional safeguards post-Schrems II.

Sealmetrics solution: EU-hosted infrastructure in Dublin, Ireland (no data transfers outside EU).

Question 6: How complex is implementation?​

Time consideration: Some tools require extensive configuration to be truly cookieless.

Sealmetrics reality: 2-minute setup, cookieless by default, no configuration needed.

Implementation Guide: Switching to Cookieless Analytics​

Step 1: Choose Your Platform​

Based on your needs:

For most businesses: Sealmetrics

  • True consentless analytics
  • No IP storage
  • Simple setup
  • DPO-approved approach

For open-source requirement: Matomo (cookieless mode)

  • Self-hosted option
  • More complex setup
  • Still hashes IPs

For basic needs: Simple Analytics

  • Very simple interface
  • Limited features
  • Still hashes IPs

Step 2: Set Up Tracking (Sealmetrics Example)​

<!-- Add before </head> tag -->
<script src="https://t.sealmetrics.com/t.js?id=YOUR_SITE_ID" defer></script>
<script>
  window.sealmetrics = window.sealmetrics || function() {
    (sealmetrics.q = sealmetrics.q || []).push(arguments)
  };
  sealmetrics('init', 'YOUR_SITE_ID');
</script>

Setup time: 2 minutes

Step 3: Verify Data Collection​

  1. Visit your website in incognito mode
  2. Check Sealmetrics dashboard for real-time visitor
  3. Verify events are tracking correctly
  4. Confirm no consent banner appears

Step 4: Remove Old Analytics (If Migrating)​

Before removing Google Analytics:

  1. Export historical data (Download reports, set up BigQuery export)
  2. Run parallel tracking for 1 week (both GA4 and Sealmetrics)
  3. Compare data quality (expect Sealmetrics to show meaningfully more traffic — the gap will land somewhere in the 15-60% range)
  4. Remove GA4 tracking code
  5. Remove consent banner (if only used for analytics)

Step 5: Update Privacy Policy​

Replace cookie consent section with:

"We use Sealmetrics, a cookieless analytics platform, to understand how visitors use our website. Sealmetrics does not use cookies, does not store IP addresses, stores nothing on your device, and cannot track you across different websites or visits. Because no personal data is retained, this measurement falls outside the scope of the GDPR and requires no consent. Data is retained for 24 months and stored exclusively in the EU (Dublin, Ireland). You can opt out at any time using our opt-out page."

Template available: Sealmetrics provides a complete privacy policy template to all customers.

Common Misconceptions About Cookieless Analytics​

Misconception 1: "Cookieless means less accurate data"​

Reality: cookieless analytics is MORE accurate, because you measure every visit rather than the 40-85% a banner lets through — and that 40-85% is not a random sample of your audience.

Data comparison (German e-commerce site, October 2024):

  • Google Analytics 4: 14,619 sessions
  • Sealmetrics (same site, same period): 32,487 sessions
  • A 55% shortfall in GA4 — toward the harder end of the range, which is what you'd expect in a privacy-sensitive market

Misconception 2: "You can't track conversions without cookies"​

Reality: Cookieless analytics tracks conversions perfectly within a session. What you can't do is attribute conversions to specific users across multiple sessions—but GDPR makes that difficult anyway without consent.

Example: User visits Monday, returns Tuesday and converts. Cookie-based analytics (with consent) can connect these sessions. Cookieless analytics sees two separate sessions, but still captures the conversion. Attribution is different, not missing.

Reality: if properly implemented (like Sealmetrics), cookieless analytics requires no consent in any EU country — because ePrivacy Article 5(3) is never triggered and, with no personal data stored, the GDPR's material scope is never engaged.

Country-specific notes:

  • Germany (TTDSG): Cookieless compliant, no consent needed
  • France (CNIL): Explicit guidance allowing cookieless without consent
  • Spain (AEPD): Follows CNIL interpretation
  • Netherlands: Cookieless exempt from cookie law

Misconception 4: "All analytics tools that claim 'no cookies' are equal"​

Reality: Many "cookieless" tools still:

  • Store hashed IP addresses (not GDPR anonymous)
  • Use localStorage (may still require consent)
  • Implement fingerprinting (illegal under GDPR)
  • Require consent "to be safe"

Only Sealmetrics provides true consentless analytics with zero IP storage and no persistent identifiers of any kind.

The Future of Web Analytics is Cookieless​

Browser vendors are killing third-party cookies:

  • Safari: Intelligent Tracking Prevention (ITP) blocks third-party cookies since 2017
  • Firefox: Enhanced Tracking Protection (ETP) blocks third-party cookies by default since 2019
  • Chrome: Third-party cookie deprecation planned for Q3 2024 (ongoing)
  • Edge: Following Chrome's timeline

Even first-party cookies face increasing restrictions:

  • Safari ITP: First-party cookies limited to 7 days storage
  • Firefox ETP: Partitioned first-party cookies in some cases
  • Brave: Aggressive cookie blocking by default

The trend is clear: Cookie-based tracking is ending, regardless of consent. Businesses that wait to adopt cookieless analytics will continue losing data.

Why Cookieless Analytics is the Answer​

Cookieless analytics solves both privacy concerns AND data accuracy:

  1. Privacy: No persistent tracking, no IP storage, no cross-site tracking
  2. Accuracy: every visit measured, none of the 15-60% consent gap
  3. Compliance: no personal data stored, so no legal basis and no consent needed
  4. Performance: Smaller scripts, faster loads, no consent management overhead

Consentless analytics (Sealmetrics' approach) takes this further by designing the entire system to require zero consent under any circumstance.

Frequently Asked Questions​

Yes — and note that it doesn't rely on a legal basis to get there. When properly implemented, no personal data is stored, so the dataset falls outside the GDPR's material scope (Recital 26), and nothing is written to the device, so ePrivacy Article 5(3) isn't triggered. CNIL's 2020 guidance confirms that analytics meeting specific criteria do not require consent.

No. If your analytics tool is truly cookieless (like Sealmetrics), you don't need a consent banner for analytics tracking. You may still need one if you use other cookies (advertising, social media, etc.).

3. How does cookieless analytics identify returning visitors?​

It doesn't. True cookieless analytics (like Sealmetrics) treats each visit as independent. Each entrance is counted as new data — there is no returning-visitor metric, because no identifier links one visit to another.

4. Can cookieless analytics track conversions?​

Yes. Cookieless analytics tracks conversions perfectly within a session. If a user visits and converts in the same session, you see the complete journey. If they return days later and convert, you see the conversion but cannot attribute it to the first visit.

These terms are used interchangeably. Both mean analytics that doesn't use cookies. However, some "cookie-free" tools still use other persistent identifiers (localStorage, fingerprinting) which may require consent.

6. Does cookieless analytics work with ad blockers?​

Partially. Sealmetrics' dual-system approach means:

  • JavaScript-enabled users: Tracked normally (session-based)
  • Ad blocker users: Tracked as isolated hits (no session connection)
  • Result: pageviews still captured, though session continuity is lost for ad blocker users (~5% of traffic)

7. How accurate is cookieless analytics compared to Google Analytics?​

More accurate for traffic volume: complete capture against Google Analytics' 40-85%. Less detailed for user journey tracking across sessions. Overall, cookieless provides more complete data within the constraints of modern privacy regulations.

8. Can I use cookieless analytics and Google Analytics together?​

Yes, but it's redundant. Most businesses find that cookieless analytics provides all the data they need without GA's complexity and data loss. During migration, running both for 1-2 weeks helps verify data accuracy.

9. Does cookieless analytics affect SEO?​

No direct effect. However, removing consent banners (made possible by cookieless analytics) can reduce bounce rates by 10-15%, which may indirectly benefit SEO through improved user engagement metrics.

10. What about data retention with cookieless analytics?​

CNIL caps tracker lifetime at 13 months and sets a 25-month ceiling on the resulting data. Sealmetrics retains aggregates for 24 months, documented as necessary for year-over-year comparison — and what is retained contains no personal identifiers.

11. Is hashing IP addresses enough to be "cookieless"?​

No. Hashing IP addresses doesn't make them anonymous under GDPR (per Breyer vs Germany ECJ ruling). True cookieless analytics (like Sealmetrics) never stores IP addresses at all—not even hashed.

12. How does cookieless analytics handle bot traffic?​

Sealmetrics filters obvious bots (search engine crawlers, monitoring services) before tracking. Session-based tracking also naturally excludes most bot traffic since bots typically don't execute JavaScript properly.

13. Can I export data from cookieless analytics?​

Yes. Sealmetrics provides CSV exports and API access for raw data. You own your data completely and can export or delete it at any time.

14. What happens if GDPR rules change?​

Sealmetrics is designed to be compliant with the strictest interpretation of current GDPR, ePrivacy, and CNIL guidance. If regulations change, we update our approach immediately. Cookie-based tools are much more vulnerable to regulatory changes.

15. How does cookieless analytics work for mobile apps?​

Mobile apps don't use cookies, so "cookieless" is a web-specific term. For mobile apps, the equivalent is identifier-free tracking. Sealmetrics is currently a web analytics platform; for mobile apps, similar privacy-first principles apply: no device ID storage, no cross-session tracking, session-based analytics only.

Conclusion: The Cookieless Analytics Advantage​

Cookie-based web analytics is dying from two forces:

  1. Legal pressure: GDPR, ePrivacy, and aggressive enforcement make cookie consent increasingly complex
  2. Technical pressure: Browsers are blocking cookies regardless of consent

Businesses that continue using cookie-based analytics face:

  • 15-60% data loss from banner ghosting and rejection
  • Legal complexity managing consent across regions
  • Poor user experience from consent banners
  • Technical unreliability as browsers block more cookies

Cookieless analytics solves all these problems by eliminating cookies entirely.

Sealmetrics goes further with true consentless analytics:

  • Every visit measured (no consent gap)
  • Zero consent required (nothing stored on the device, no personal data retained)
  • No IP storage (more private than any competitor)
  • 2-minute setup (cookieless by default)
  • EU-hosted (no data transfers, no Schrems II concerns)

The future of web analytics is cookieless. The question isn't whether to make the switch, but how quickly you can implement it.

Additional Resources​

Learn more about cookieless analytics:

Legal and compliance:

Try Sealmetrics:

About the Author: This guide was written by the Sealmetrics team, creators of the leading consentless analytics platform. We believe accurate data and user privacy are not opposites—they're requirements for modern web analytics.

Last Updated: March 10, 2026

Sealmetrics measures all of your website traffic without cookies, consent banners, or IP address storage. Privacy by architecture, trusted by privacy-conscious businesses across Europe.