Cookieless web analytics, explained

Traditional analytics writes a cookie — a small, persistent identifier stored on the visitor’s device — so it can recognise the same browser across pages, sessions and even other sites. That persistent identifier is what turns aggregate web analytics into personal data, and it is what triggers the consent requirement in the EU.

Cookieless analytics removes that identifier entirely. Pulse’s tracking script sends a single anonymous event per pageview containing the page path, the referrer, the device type and browser, and a country resolved from the IP address at the moment of the request. The IP itself is never stored. To tie the pageviews of one visit together — so an entry page and an exit page belong to the same session — the server derives a salted hash that rotates every day, and a second, monthly-rotating hash deduplicates unique visitors; both follow the site’s own calendar and neither ever reaches the browser. The only thing the script touches client-side is a five-second sessionStorage guard against double-counting a refresh — never transmitted, wiped with the tab.

There is no client-side key, no cross-site key, and no fingerprint. A returning visitor is deduplicated within a calendar month and then the key rotates away — no long-lived profile ever exists, which is precisely why the method collects no personal data and needs no cookie banner. A site owner can switch on visitor-level views to read that month’s groupings one reader at a time; the month is still the horizon, and the key is still gone at the end of it.

The worry with dropping cookies is that the numbers get worse. In practice the opposite is usually true. Cookie-based analytics only ever sees the visitors who accept the consent banner, and it is the single most-blocked category of script in ad- and tracker-blockers. A cookieless script that needs no consent runs for everyone and is far less likely to be blocked, so it captures a more complete picture of real traffic.

Pulse still gives you the reports teams look at every day: real-time visitors, pageviews, unique visitors, top pages, referrers and UTM campaigns, entry and exit pages, device, browser and country breakdowns, and custom events for the actions that matter. The tracking script is under three kilobytes and loads asynchronously, so it does not slow the page down. And because the dashboard and script are open (AGPL) with a public live demo, you can inspect exactly what is measured rather than take it on trust.