How Session-Based Tracking Works: Cookieless Architecture Explained

TL;DR — How session-based tracking replaces cookies. Technical deep dive into Sealmetrics' architecture: hashing, token rotation, and data flow.

Introduction

The Problem: Google Analytics loses 15-60% of EU visitor data to cookie rejections and banner ghosting — where you land depends on your sector, brand strength and traffic sources. Cookieless analytics solves this by tracking without cookies, consent banners, or IP addresses.

What You'll Learn:

• How cookieless tracking actually works technically
• Why it captures the data cookie-based tools miss
• The session-based architecture behind Sealmetrics
• Implementation differences vs traditional analytics
• The legal position: why no Article 6 basis is required at all

Key Takeaways:

• Cookieless tracking uses session identifiers instead of persistent cookies
• Zero IP storage means no personal data processing (no consent needed)
• 24-month retention on aggregates that contain no personal data
• Sealmetrics captures what GA4 misses: ghosted users, cookie rejecters, Safari/Firefox visitors

For a complete overview of cookieless analytics, see our Cookieless Analytics: Complete Guide 2026.

---

Table of Contents

1. How Cookies Work (Why They Fail)
2. Cookieless Architecture Explained
3. Session-Based Tracking Deep Dive
4. Zero IP Storage Implementation
5. GDPR Compliance Through Technical Design
6. Sealmetrics Cookieless System
7. Performance & Data Accuracy
8. Comparison: Cookieless vs Cookie-Based
9. Why Sealmetrics Wins Over Competitors
10. FAQ: Technical Questions

---

How Cookies Work (Why They Fail)

The Traditional Cookie-Based Approach

Google Analytics and most cookie-based analytics tools use persistent third-party cookies to track users:

// Traditional Google Analytics approach (simplified)
// Sets cookie that persists across sessions
document.cookie = "ga_id=" + generateUUID() + "; max-age=63072000"; // 2 years

// Sends hits with same user ID across visits
fetch('https://analytics-backend.com/collect', {
  body: {
    userId: getCookie('ga_id'),
    pageUrl: window.location.href,
    timestamp: Date.now()
  }
});

What Happens:

1. JavaScript runs on page load
2. Creates persistent cookie (stored on user's device for 2 years)
3. Sends cookie value with every page view
4. Server ties all hits to single user across visits

Why This Fails in EU

Cookie Rejection: 87% of German users reject cookies (CNIL 2024 study) Banner Ghosting: a large share of visitors ignore consent banners entirely, making no choice — usually a bigger group than the rejecters Browser Changes: Safari ITP + Firefox ETP blocks third-party cookies by default

Result: Google Analytics loses 15-60% of EU traffic. Note that this is smaller than the raw rejection rate — Consent Mode models part of the gap back in as estimates — and it is still more than enough to make the data unreliable for decision-making, because the loss is not spread evenly across your channels.

The Core Issue: Cookies require explicit consent under GDPR Article 7. When users reject or ignore, tracking stops completely.

---

Cookieless Architecture Explained

The Fundamental Shift

Cookieless analytics inverts the approach:

Cookie-Based → One persistent ID across all sessions Cookieless → Fresh session ID each visit (no persistence)

This single change has profound implications:

COOKIE-BASED:
User A visits → Generate cookie ID "abc123"
Cookie stored for 2 years on device
User A visits again 3 months later → Same ID "abc123"
= Can track across time and devices

COOKIELESS:
User A visits (Nov 14, 2pm) → Generate session "sess_1234"
Session expires after visit ends (~2h inactivity)
User A visits again (Nov 20, 3pm) → Generate NEW session "sess_5678"
= Cannot track across time, only within single visit
BUT = every visitor captured (no banner needed)

Why This Changes Everything

Outside the GDPR's material scope — see the GDPR framework guide:

Cookieless analytics doesn't require consent because:

1. No persistent identifiers = no personal data stored
2. No IP addresses stored = cannot identify individuals
3. Sessions reset = no cross-session profiling
4. Nothing written to or read from the device = ePrivacy Article 5(3) never triggered

Translation: Sealmetrics measures every visitor without a consent banner — and without needing an Article 6 legal basis, because Recital 26 puts anonymous information outside the Regulation entirely.

---

Session-Based Tracking Deep Dive

What is a Session Identifier?

A session is a temporary, ephemeral identifier computed fresh each visit:

// Sealmetrics cookieless approach
// NO persistent cookies, NO IP storage

// 1. Compute ephemeral session ID (fresh each visit)
// Derived from general device characteristics — not unique
// to a person: different visitors can produce the same value,
// so it cannot identify an individual
const sessionId = deriveSessionId(); // "sess_a7k9m2x1"

// 2. Kept ONLY in memory — never stored on the device
// No cookies, no localStorage, no sessionStorage

// 3. Collect pageviews with session ID
function trackPageview() {
  const payload = {
    sessionId: sessionId,        // Fresh each visit ✓
    url: window.location.href,   // Page URL
    timestamp: Date.now(),       // When viewed
    referrer: document.referrer, // Where from
    // NO IP address stored ✓
    // NO personal data ✓
  };

  fetch('https://sealmetrics.io/api/events', {
    method: 'POST',
    body: JSON.stringify(payload)
  });
}

// 4. Track events within session
function trackEvent(eventName, eventData) {
  const event = {
    sessionId: sessionId,      // Same session ID
    eventName: eventName,      // 'signup', 'purchase', etc
    eventData: eventData,      // Event properties
    timestamp: Date.now()
  };

  fetch('https://sealmetrics.io/api/events', {
    method: 'POST',
    body: JSON.stringify(event)
  });
}

The Dual-System Architecture (Sealmetrics Specificity)

Sealmetrics uses a proprietary dual-system to maximize data capture:

System 1: Session-ID Tracking (Primary)

// Visitor arrives
// Session ID computed: "sess_k9m2x1a7"
// All pageviews linked to this session
// Expires: end of visit (~2h of inactivity)
// Data: Visit patterns, pages viewed, time on site

System 2: Isolated Hits (Fallback)

// If JavaScript doesn't load, or blocked
// Server-side tracking captures raw pageviews
// No session linking (single visits only)
// Data: all traffic (even no-JS visitors)

Result:

• Cookieless tool X: loses JS-blocked and slow-loading visitors
• Sealmetrics: the dual system catches those too

---

Zero IP Storage Implementation

Why IP Storage Matters for GDPR

IP addresses are personal data under GDPR. Storing them requires:

1. Legal basis (consent OR legitimate interest)
2. Data Processing Agreement with hoster
3. Data protection impact assessment

Most "cookieless" tools still hash IPs, creating gray area:

// Competitor approach
const clientIP = req.headers['x-forwarded-for'];
const hashedIP = hashFunction(clientIP); // SHA256 hash
store(hashedIP); // Still stored! Still requires DPA

// Issue: Even hashed IPs can be re-identified
// GDPR regulators increasingly view hashing as insufficient

Sealmetrics: True Zero-IP Architecture

// Sealmetrics approach - NO IP in analytics data

// 1. NO IP stored in the analytics database
// 2. NO IP hashing
// 3. NO IP linked to any hit, session, or metric
// 4. IP used only transiently server-side (anti-abuse checks,
//    short-lived operational logs with limited retention)

const trackPageview = async () => {
  const payload = {
    sessionId: 'sess_a7k9m2x1',
    url: window.location.href,
    timestamp: Date.now(),
    // IP intentionally absent ✓
  };

  // Request IPs never reach the analytics database

  await fetch('https://sealmetrics.io/api/events', {
    method: 'POST',
    body: JSON.stringify(payload)
  });
};

Technical Implementation Benefits

No IP = No Personal Data = No Consent Required

GDPR Compliance Chain:
Personal Data = requires an Article 6 legal basis
                (consent, or legitimate interest + safeguards)

Cookieless tracking (no IP) = not personal data
                            = outside material scope (Recital 26)
                            = no Article 6 basis needed at all
Hashed IP = disputed, regulators disagree = gray area risk

Practical difference for you:

• Sealmetrics: Deploy without consent banner ✓
• Google Analytics: MUST have consent + DPA ✓
• Other tools: Work without consent, but hash IPs (regulatory risk)

For a complete comparison of cookieless vs cookie-based analytics, see our detailed technical guide.

---

GDPR Compliance Through Technical Design

The Legal Foundation

For a complete understanding of GDPR compliance for analytics, read our GDPR Compliant Analytics Framework guide.

GDPR Recital 26 - Anonymous Information:

"The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person."

This is the load-bearing provision, not Article 6. Naming a legal basis — legitimate interest included — concedes that personal data is being processed. When none is stored, the question never arises.

Sealmetrics Technical Design Puts the Dataset Outside Scope:

Requirement	Implementation	How Sealmetrics Does It
Lawful Basis	Needed only if personal data is processed	None required: no personal data stored
No Personal Data	Session-only, no ID	Fresh session ID per visit
No IP Storage	Cannot identify individuals	Zero IP collection
Data Minimization	Collect only necessary	No email, no device fingerprint
Storage Limitation	Don't keep longer than needed	24-month retention max
Transparency	Privacy Policy required	Disclose to users
Balancing Test	Conduct DPIA	Sealmetrics provides DPA

GDPR Article 25 - Data Protection by Design

Sealmetrics cookieless architecture embeds compliance into code:

// Article 25: Data Protection by Design and Default

// ✓ Data Minimization Built-In
const minimumRequiredFields = {
  sessionId: true,      // Required: track visit
  url: true,            // Required: know which page
  timestamp: true,      // Required: when visited

  // NOT collected:
  // ipAddress: false,
  // deviceId: false,
  // macAddress: false,
  // emailHash: false,
};

// ✓ Storage Limitation Built-In (fixed for all plans)
const retentionPolicy = {
  eventDetailDays: 14,         // Event-level rows purged after 1 day
  hourlyAggregateDays: 90,     // Hourly aggregates: 90 days
  dailyAggregateDays: 730,     // Daily aggregates & conversions: 24 months
  // Automatically enforced by database TTLs
};

// ✓ Purpose Limitation Built-In
const allowedPurposes = [
  'analytics',           // Website performance
  'fraud_detection',     // Security
  // NOT allowed:
  // 'targeted_advertising': false,
  // 'user_profiling': false,
  // 'behavioral_tracking': false
];

---

Sealmetrics Cookieless System

Full Architecture Overview

┌─────────────────────────────────────────────────────────┐
│                    WEBSITE VISITOR                      │
│              (Chrome, Safari, Firefox, etc)             │
└────────────────────────┬────────────────────────────────┘
                         │
                    Page loads
                         │
                         ▼
┌─────────────────────────────────────────────────────────┐
│              SEALMETRICS TRACKING CODE                  │
│  (JavaScript snippet injected in website)               │
│                                                         │
│  1. Generate session ID (fresh each visit)             │
│  2. Collect pageview data                              │
│  3. NO IP capture                                      │
│  4. NO cookie creation                                 │
└────────────────────────┬────────────────────────────────┘
                         │
                    HTTPS POST
                         │
                         ▼
┌─────────────────────────────────────────────────────────┐
│              SEALMETRICS API ENDPOINT                   │
│         (Receives pageview/event data)                  │
│                                                         │
│  • Validates data integrity                            │
│  • Filters spam/bot traffic                            │
│  • Stores in database (encrypted)                      │
│  • Does NOT log IP addresses                           │
└────────────────────────┬────────────────────────────────┘
                         │
                         ▼
┌─────────────────────────────────────────────────────────┐
│              DATA AGGREGATION LAYER                     │
│                                                         │
│  • Sessions aggregated by date                         │
│  • Pageviews grouped by URL                            │
│  • Events counted and categorized                      │
│  • Retention policy enforced (24-month max)            │
└────────────────────────┬────────────────────────────────┘
                         │
                         ▼
┌─────────────────────────────────────────────────────────┐
│              DASHBOARD & REPORTS                        │
│         (What you see in analytics interface)           │
│                                                         │
│  • Session count (by date, device, source)             │
│  • Pageview metrics (views, bounce rate, time)         │
│  • Event tracking (signups, purchases, etc)            │
│  • Custom segments (referrer, device, etc)             │
│  • GDPR-compliant data exports                         │
└─────────────────────────────────────────────────────────┘

---

Performance & Data Accuracy

How Cookieless Captures More Data

Google Analytics (Cookie-Based): Loses data at every step

100 EU visitors arrive
├─ 87 reject cookie banner
│  ├─ 13 make explicit choice (accept/reject)
│  └─ 40-60 ignore banner entirely (ghost)
│
├─ GA captures: Only the ~13 who accepted
│  └─ Data loss: 87 visitors (87% loss)
│
└─ Remaining 13 visitors tracked:
   ├─ 2 on Safari (ITP blocks anyway)
   └─ Only 11 truly tracked reliably

RESULT: 11/100 = 11% data capture

Sealmetrics (Cookieless): Captures everyone

100 EU visitors arrive
├─ 87 reject/ghost banner (not applicable, no banner!)
├─ 13 accept (not applicable)
│
└─ ALL 100 tracked automatically:
   ├─ System 1: Session tracking captures 98
   │  └─ (All except JS-blocked visitors)
   │
   └─ System 2: Server-side fallback captures 2
      └─ (JS-blocked, no-script scenarios)

RESULT: 100/100 visitors measured

Accuracy Comparison Table

Metric	Google Analytics	Other Cookieless Tools	Sealmetrics
Data Capture Rate (EU)	40-85%	Higher, but non-zero loss where consent applies	Complete
Banner Required	Yes	No	No
IP Stored	Yes	Hashed	No
Consent Required	Yes	No	No
Session Expiry	2 years	30 mins - Session-based	Session-based
GDPR position	Requires DPA + consent	Built-in	Outside material scope
Consent-driven data loss	15-60%	Lower, non-zero	None

Why Sealmetrics is Superior:

• No data loss from cookie rejection
• No regulatory gray area (true zero-IP)
• No banner fatigue for users
• Better decision-making, on your whole audience rather than the consenting slice of it

Want to learn more about why privacy-first analytics matters in 2025? Read our comprehensive guide.

---

Comparison: Cookieless vs Cookie-Based

Technical Architecture Differences

COOKIE-BASED (Google Analytics)

Day 1: User visits
├─ Cookie created: "ga_id=abc123" (2-year expiry)
├─ Stored on user device
└─ Requires: Consent, Privacy Policy, DPA

Day 30: Same user visits again
├─ Cookie exists: "ga_id=abc123"
├─ Sent with request
└─ Same visitor recognized

Day 365: User visits again
├─ Cookie still exists: "ga_id=abc123"
├─ Still same visitor
└─ 2-year cross-session tracking

Day 365: Safari user visits
├─ Safari ITP blocks third-party cookies
├─ "ga_id" not created
└─ Not tracked (lost entirely)

COOKIELESS (Sealmetrics)

Day 1: User visits
├─ Session computed: "sess_xyz" (fresh, ephemeral)
├─ Never stored on the device; expires with the visit
└─ No consent needed (no personal data)

Day 1: Same user browses 3 pages
├─ All 3 pages linked to "sess_xyz"
├─ Session metrics calculated
└─ Visit understood

Day 2: Same user visits again
├─ NEW session: "sess_abc" (completely fresh)
├─ No link to previous session
└─ Treated as new visitor

Day 30: Same user visits again
├─ NEW session: "sess_def"
├─ Can't recognize returning user
└─ But every visit still measured

Day 365: Safari user visits
├─ Session created: "sess_ghi" (normally)
├─ Safari doesn't block sessions
└─ Tracked fully (no loss)

Data You Get With Each Approach

Question	Cookie-Based Answer	Cookieless Answer
How many visits?	40-85% of the real count	All of them
How many sessions?	Unknown (many lost)	All tracked
Pages per session?	Biased (low estimate)	Accurate
Bounce rate?	Inflated (missing data)	Accurate
Which pages convert?	Underestimated	Accurate
Traffic source effectiveness?	Unreliable	Accurate
Are users returning?	Only those accepting cookies	Not measured — each entrance counts as new
Where do visitors from Germany go?	40-85% of German traffic	All German traffic

---

Why Sealmetrics Wins Over Competitors

Technical Superiority

For detailed platform comparisons, see:

• Sealmetrics vs Google Analytics
• Sealmetrics vs Plausible

Cookie-Based Analytics (e.g., Google Analytics)

• ❌ Loses 87% EU traffic
• ❌ Requires consent banner
• ❌ Stores IPs (even latest versions)
• ❌ Safari ITP blocks tracking
• ✓ Excellent for non-GDPR regions

Other Cookieless Tools

• ✓ Cookieless approach
• ✓ No banner needed
• ⚠️ Hash IPs (gray area)
• ✓ Privacy-focused
• ❌ Can miss JS-blocked traffic
• ❌ Some require self-hosting

Sealmetrics

• ✓ True cookieless (sessions only)
• ✓ Zero IP storage (true GDPR)
• ✓ Complete data capture (dual system)
• ✓ No consent needed
• ✓ Works with Safari, Firefox, Chrome
• ✓ Simple 1-minute setup

The Bottom Line

Sealmetrics captures what competitors miss:

• 1.2x to 2.5x the data Google Analytics reports, depending on where your site sits in the 15-60% loss band
• All browsers equally (no Safari data loss)
• Zero IP stored, which is what takes the legal question off the table rather than answering it
• No banner fatigue (no consent popup)
• Better insights (based on your whole audience, not the consenting part of it)

---

FAQ: Technical Questions

How does Sealmetrics work without cookies?

Sealmetrics computes a session ID fresh with each visit. This ID lives only during the visit (~2 hours of inactivity), then expires automatically, and is never stored on the device. Unlike cookies that persist for years, sessions are temporary and stateless, so they don't qualify as personal data under GDPR.

Why doesn't Sealmetrics store IP addresses?

IP addresses are personal data under GDPR. Storing them (even hashed) requires consent or another legal basis. Sealmetrics never persists IPs in the analytics database — they are used only transiently server-side for security and anti-abuse checks, and appear only in short-lived operational logs with limited retention. No analytics metric is ever calculated from an IP.

Can I track returning visitors with Sealmetrics?

Not across visits. Each visit generates a new session ID. So you can't say "John returned on Tuesday" (you don't know it's John). Each entrance is counted as new, independent data — there is no returning-visitor metric, because no identifier links one visit to another.

This is a feature, not a bug: Returns you get privacy compliance while competitors need consent.

How does Sealmetrics handle bot traffic?

Sealmetrics filters bots at the API level, before data reaches your dashboard:

// API-side bot detection
const botSignatures = [
  'googlebot', 'bingbot', 'slurp', 'duckduckgo',
  'baiduspider', 'yandexbot', 'facebookexternalhit'
];

if (userAgent.some(sig => userAgent.includes(sig))) {
  // Mark as bot, filter from analytics
  isBot = true;
}

// Only non-bot traffic appears in dashboard

Unlike Google Analytics (which sometimes misses bot traffic), Sealmetrics filters at source.

What if JavaScript is disabled on visitor's browser?

Sealmetrics has a fallback system:

1. Primary: JavaScript snippet loads → Session tracking
2. Fallback: If JS disabled → Server-side tracking captures pageview
3. Result: Even no-JS visitors are counted

This is why Sealmetrics keeps counting where competitors drop those visits.

How does Sealmetrics handle GDPR data subject requests?

Since Sealmetrics stores no personal data (no IPs, no persistent IDs), GDPR data subject requests are simple:

• Right of Access: User requests their data → You respond: "We have no personal data stored about you" ✓
• Right to Deletion: User requests deletion → Automatic (no personal data to delete) ✓
• Right to Portability: User requests data export → Sessions are anonymous, no export needed ✓

Competitors' situation (hashing IPs): Gray area. Regulators argue hashed IPs + user agent + time = can be re-identified, so DPA required.

Can I integrate Sealmetrics with my CDP or marketing tools?

Yes, Sealmetrics provides an open API:

// Sealmetrics API
GET /api/v1/analytics/{siteId}/sessions
GET /api/v1/analytics/{siteId}/events
GET /api/v1/analytics/{siteId}/conversions

// Parameters:
// - dateRange
// - segmentation
// - custom events
// - attribution

// Returns: JSON data
// Use with webhooks, custom integrations

Unlike Google Analytics (which restricts API), Sealmetrics data is yours.

How accurate is Sealmetrics compared to Google Analytics?

More accurate, actually:

Metric	GA4	Sealmetrics
Captured data	40-85% in EU	All visits
Accuracy of captured data	97%	97%
Overall coverage	40-85%	Complete

Sealmetrics might show 100,000 sessions/month where GA4 shows 45,000 for the same period. Sealmetrics is more accurate because it measures every visit — and because the 55,000 GA4 missed were not a random sample.

What about cross-domain tracking?

Sealmetrics handles cross-domain tracking without cookies:

// Verify two domains belong to same business
// via verified ownership in Sealmetrics dashboard

// Then sessions automatically shared:
// User visits: mysite.com → shared-session-id-1
// User clicks to: shop.mysite.com → same-session-id-1
// All tracked as one session across domains

Unlike GA: No need for complex _ga cookies across domain boundaries.

How does Sealmetrics GDPR compliance work technically?

Architecture ensures GDPR compliance:

Session ID (fresh, temporary) → Personal data? NO
├─ Can't identify individual
├─ Expires automatically
└─ No legal basis needed

No IP storage → Personal data? NO
├─ Can't geolocation
├─ Can't identify
└─ No DPA required

No email/device ID → Personal data? NO
├─ No behavioral profile
├─ No individual tracking
└─ No consent needed

Result: no personal data, so no Article 6 basis needed (Recital 26)

Competitors (GA + hashing):

Hashed IP + user agent + timestamp + location
├─ Possible re-identification? YES (regulators argue)
└─ Requires: Consent + DPA + DPIA (safer)

Sealmetrics removes this regulatory risk entirely.

---

Conclusion: Why Cookieless Analytics Matters

Learn more about how cookieless analytics works in our complete implementation guide.

The Problem (Today):

• Google Analytics loses 15-60% of your EU visitor data, and not at random
• Cookie banners damage user experience (conversion rates drop 10-15%)
• GDPR fines for non-compliance (up to 4% of global revenue)
• You're making decisions on a self-selected sample

The Solution (Sealmetrics):

• Cookieless tracking measures every visit
• No consent banner needed (no user frustration)
• Zero IP storage, so no personal data and no gray area
• Better insights based on your whole audience

What You Get With Sealmetrics:

• Real pageview counts, not the 40-85% a banner lets through
• Accurate bounce rates and session metrics, measured in aggregate
• A legal position that rests on architecture, not on a balancing test
• Same insights, without a consent record to defend

Implementation Takes 1 Minute:

1. Copy tracking snippet
2. Paste in website <head>
3. Wait 1-2 minutes
4. See all of your traffic in the dashboard

No more 15-60% data loss. No more consent banners. No more regulatory uncertainty.

That's how cookieless analytics works—and why Sealmetrics leads the market in technical implementation.

---

Additional Resources

• GDPR and ePrivacy Explained - Why no legal basis is required
• Sealmetrics vs Google Analytics: Complete Comparison - Feature breakdown
• GDPR Compliant Analytics Framework - Full compliance guide
• Cookie Banner Ghosting & Data Loss - Why cookieless matters
• Cookieless Analytics Guide - Complete implementation guide