How cookieless analytics counts unique visitors

Traditional analytics recognises a returning visitor by putting an identifier in a cookie. Cookieless analytics can't do that, so how does it know that ten pageviews came from one person and not ten? This guide explains the method most privacy-first tools use, what it collects, what it deliberately forgets, and how accurate the numbers are.

The daily-salted hash#

When a page loads, the script sends a tiny request with the page URL, the referrer, the screen width and the browser language. The server also sees, as every web server does, the visitor's IP address and user agent. It then computes:

visitor_id = hash(daily_salt + site_id + ip_address + user_agent)

• daily_salt is a long random value created at midnight and deleted the next day.
• site_id makes the id different on every website, so a person can't be followed from site to site.
• The IP address and user agent are used for this calculation and to derive country, device and browser, and then discarded. They are never written to the database.

Within a day, the same browser on the same connection produces the same id, so pageviews, sessions, bounce rate and visit duration work. The next day there is a new salt, so the same person produces a completely different id. Once the old salt is deleted, nobody, not even the provider, can recompute which id belonged to which IP.

What is stored, and what is not#

Is it "anonymous"? Not on the day of the visit: while the salt exists the id is pseudonymised data, so the GDPR applies, which is why you still mention it in your privacy policy (see Do you need a cookie banner for web analytics?). After the salt is deleted the link to the person is gone.

How accurate is it?#

More accurate than you might expect, and in one important way more accurate than cookie-based tools.

Where it is more accurate: there is no consent banner to decline, so every visit is counted, not only the visitors who clicked "accept". Ad blockers still block some scripts, but you no longer lose the share of visitors who refuse cookies.

Where it differs:

• A person who visits on two different days counts as a visitor on each day. Over a month, "visitors" is the sum of daily visitors, so it measures visitor-days, not unique people over the month.
• The same person on a phone and a laptop counts twice (cookie-based tools usually do too).
• A phone switching from Wi-Fi to mobile data changes IP, and may start a new id that day.
• People behind the same corporate IP with an identical browser version may occasionally merge.

For decisions such as "which pages and sources bring people who convert", these differences don't matter: trends and ratios are reliable. What you give up is long-term tracking of individuals, which is exactly the point.

What you can still measure#

Everything most sites need: visitors, pageviews, bounce rate, visit duration, entry and exit pages, sources and channels (including traffic from AI assistants), UTM campaigns, devices, countries, goals, funnels within a day, and revenue events. What you can't do is retarget or build cross-day user profiles.

How byanalytics implements it#

byanalytics uses exactly this method: a 2 KB script with no cookies and no device storage, a salt that rotates every UTC day and is deleted, and the IP used only in memory. The visit-level data is kept for your plan's retention and the daily aggregates remain afterwards, with no visitor ids in them. The technical details are in our privacy documentation. If you are choosing a tool, our checklist of Google Analytics alternatives helps.

FAQ#

How does cookieless analytics count unique visitors?#

It hashes a random daily salt together with the site id, the IP address and the user agent. The same browser produces the same id during that day, and a different one the next day once the salt is replaced and deleted.

Is cookieless analytics accurate?#

For trends, sources, pages and conversions, yes, and without a banner it counts visitors who would have refused cookies. It counts a returning visitor once per day, so monthly "visitors" are visitor-days rather than unique people.

Is a hashed IP address anonymous?#

Not while the salt exists: it is pseudonymised data under the GDPR. Once the daily salt is deleted, the hash can no longer be linked back to the IP address.

Is fingerprinting the same as cookieless analytics?#

No. Fingerprinting combines many browser attributes to recognise a device over time and across sites. A daily-salted hash deliberately forgets the visitor every day and is different on every site.