Cookieless tracking: how it works and why it is GDPR-safe

A traditional analytics tool sets a cookie in the visitor’s browser so it can recognise the same person across page loads and sessions. That cookie is personal data under the GDPR and the ePrivacy Directive, which is why every site that runs a cookie-based tool needs a consent banner asking for permission before the script even loads.

A cookieless tool takes a different path. It identifies each visitor with a short-lived, salted hash of non-personal signals, the visitor’s IP address, browser, and the domain they are on. The hash is not a cookie: it is never written to the visitor’s device, it rotates daily so it cannot be used to follow a person over time, and the raw IP is discarded. What remains is the aggregate data you actually need: how many people visited, where they came from, what they looked at.

MetriXs computes a visitor identifier as:

HMAC-SHA256(daily_salt, SECRET + ":" + ip + "|" + ua + "|" + domain)

The result is truncated to 32 hex characters and stored as the visitor id. Here is what each piece does:

• daily_salt is a random value that rotates at midnight UTC. It is kept in a fast cache for 49 hours, so a session that spans midnight stays continuous while a brand-new day produces a fresh, unlinkable identifier.
• SECRET is a server-side key the visitor never sees. Without it, the hash cannot be reproduced or reversed.
• ip, ua, domain are the non-personal signals that together distinguish one visitor from another on a given day.

The raw IP address is never persisted. Only the 32-character hash is stored. Because the salt rotates daily, the same visitor gets a different hash each day, so the hashes cannot be stitched together into a long-term profile.

The ePrivacy Directive’s consent requirement is triggered by setting cookies or otherwise accessing or storing information on a visitor’s device. MetriXs does neither: no cookies, no localStorage, nothing written to the browser. So the ePrivacy consent step does not apply.

The GDPR still governs the processing, but because no personal data is stored (the hash cannot be traced back to an individual and resets daily), the obligations are minimal. There is no personal data to return in a subject access request, and no personal data to erase in an erasure request. This is compliance by architecture: the tool is built so that the heavy GDPR obligations never trigger, rather than configured to satisfy them after the fact.

Cookieless tracking gives you the aggregate traffic metrics most teams actually use: visitors, pageviews, traffic sources, geography, devices, bounce rate, and session duration. It does this without a consent banner, without a consent management platform, and without losing the visitors who would have clicked "reject all".

What it does not do is track individual users across sessions and sites over time. There is no cross-site or cross-device user profile, no demographic modelling. If your business genuinely needs individual-level attribution (for example, tying a visitor to a CRM record across months), cookieless tracking is not the right fit. For most websites, aggregate trends are what they actually need, and the privacy and simplicity wins are worth the trade-off.