Skip to main content

How Consentless Tracking Works

Consentless tracking measures events in aggregate instead of following people. The tracker records four non-identifying variables per hit — timestamp, user agent, current URL and referral URL — sends them to EU infrastructure, and never writes anything to the visitor's device. Because there is no identifier and nothing stored on the device, there is nothing to ask consent for.

The mechanics, in four steps​

  1. Event detection. A JavaScript tracker (1.3 KB gzipped) fires on page load and on events you instrument. It sets no cookies and uses no localStorage, sessionStorage or fingerprinting.
  2. Transmission. The hit is sent as a lightweight beacon request. The visitor's IP appears at the network layer, as it does for any HTTP request, but is never persisted in the analytics database — it is used in memory only for anti-abuse checks and site-configured exclusions.
  3. Isolated processing. Each hit is processed on its own. Hits from the same person are never joined across sessions, so no journey or profile can be reconstructed.
  4. Aggregation. Reports are built from aggregate counts. Event-level rows — including the raw user agent string — are purged after 1 day; hourly aggregates are kept 90 days; daily aggregates and conversions 24 months. Retention is fixed for every plan and enforced by database TTLs.

All customer analytics data is stored and processed in Dublin, Ireland (EU).

Two measurement modes​

Isolated hits — every page view is an independent, anonymous event with no link to any other event. This is the most privacy-preserving mode: pure aggregate counting.

Session-marked hits — a short-lived, context-derived marker groups the hits of one visit (roughly a two-hour inactivity window). It is held in memory, never written to the device, and cannot recognise a returning visitor. Markers incorporate the publisher account, so the same browser produces different markers on different sites and no cross-site correlation is possible. This is what makes within-session metrics such as bounce rate and pages per session possible without an identifier.

No personal data is collected, so the GDPR obligations that attach to personal data are not triggered; and nothing is stored on or read from the visitor's terminal equipment, so the ePrivacy Directive's Article 5(3) consent requirement does not attach either. Cookie-based tools face the opposite situation, which is why they typically lose 15–60% of visitor data in EU markets when visitors decline, depending on sector, brand strength and traffic mix.

Sealmetrics holds no third-party security certification, and no supervisory authority certifies analytics tools — the compliance pages are self-assessments against published criteria.

Where to read the detail​