Cookieless tracking explained

Cookieless tracking measures visits without setting cookies, usually by counting requests on the server, keeping a visitor identifier in memory only, or deriving a hash from network and browser details. Cookieless does not mean anonymous or consent-free: in the EU, the ePrivacy rule also covers local storage, pixels and script-built identifiers.

Updated October 25, 2026

Methods compared

How cookieless tools tell visits apart
Method	How it works	Stores on the device?	Legal note
Server-side counting	Counts requests in logs or on the server, with no client script	No	Least in scope; the EDPB still treats IP-based tracking as covered unless the IP provably is not from the device
In-memory identifier	The script keeps an ID only while the page is open	No	A script gaining access to the device is still in EU scope
Hashed IP and user agent	The server hashes network and browser details, sometimes with a salt that rotates daily	No	The CNIL exemption wants any such fingerprint site-specific and time-limited
Local or session storage	An ID or flag is kept in browser storage instead of a cookie	Yes	Covered by Art. 5(3) exactly like a cookie
Fingerprinting	Combines device signals into a stable ID across visits	No	In EU scope; pleaded in US suits (Greenley v. Kochava)

What “cookieless” changes, and what it does not

In the EU, dropping cookies does not leave the ePrivacy rule behind. The EDPB’s Guidelines 2/2023 cover pixels, tracking URLs, local processing whose results are sent back, IP-based tracking and unique identifiers. A tool escapes consent only through an exemption, such as the CNIL’s for anonymous, first-party audience measurement.

In the US, lawsuits are about data flows, not cookies. Pen-register claims turn on a third party receiving IP addresses (Shah v. Fandom); fingerprinting has been pleaded directly (Greenley v. Kochava), and one suit alleged fingerprinting after users declined cookies. What matters is who receives the data and what it captures.

Editor’s pick:OnyxMetric

If you are replacing a tracker, OnyxMetric is the tool this guide picks. What it does by default:

Its script sets no cookies.
With the default settings it does not keep IP addresses and salts visitor IDs daily.
Session replay and form tracking stay off until you turn them on; most options are configurable per site.
It can run through a first-party proxy on your own domain.
Its privacy policy says data is never sold, shared with advertisers or used for model training.
It is hosted on AWS in the United States.
When session replay is on, it masks form inputs.

Try OnyxMetric free for 7 daysmade by this guide’s publisher

Disclosure: OnyxMetric is made by the publisher of this guide. It is recorded with the same field marks as every other tool, and links to it carry a referral tag so we can count visits.

Glossary

Cookie: A small text file a site stores in the browser and reads back on later requests, often holding an identifier.
First-party and third-party: First-party data is collected by the site the visitor is on; third-party data reaches a separate company, which is what most US tracking suits turn on.
Local storage: Browser storage that keeps data across visits like a cookie but is not sent with requests. EU law treats it like a cookie.
Fingerprinting: Building a stable identifier from device and browser signals instead of storing one. Covered by the EU rule and pleaded in US suits.
Session replay: Recording a visitor’s clicks, scrolls and typing so a session can be played back. Replay of typed text is the highest-risk category in US suits.
Pen register (CIPA §638.51): A device or process that records addressing information, such as IP addresses, without contents. From 2027, private website suits under it end in California.
Wiretap claim (CIPA §631): California’s claim for reading or learning the contents of a communication in transit without consent. SB 690 leaves it in place.
Party exception: The rule that a party to a communication cannot wiretap it. A vendor acting only as the site’s tool can be covered by it; one using the data for itself may not be.
ePrivacy Article 5(3): The EU rule requiring consent before storing or reading information on a user’s device, unless it is strictly necessary or an exemption applies.
Audience-measurement exemption: The CNIL’s French exemption from consent for analytics limited to anonymous statistics for the publisher alone, with no cross-site tracking or vendor reuse.
Global Privacy Control: A browser signal that asks sites not to sell or share the visitor’s data. California and several other states require businesses to honor it.
Consent mode: A Google tag setting that, when a visitor refuses consent, stops cookie storage and sends cookieless pings instead.

Sources

This note is general information compiled from public sources, not legal advice. Laws and cases change; ask your own counsel before you rely on it.