Cookie-free analytics: what you can measure without a consent banner

Most teams assume analytics needs cookies, and that cookies mean a consent banner. That assumption is expensive: banners cost conversions, they are the first thing a visitor closes, and in the EU they are legally required before you set anything that stores or reads data on a device.

The good news is that almost everything a marketing team actually uses can be measured without cookies at all. The trick is being clear about what changes when you drop them.

What counts as a cookie-free setup

A cookieless tracker sets no cookies and does not fingerprint the device. Instead it derives a short, anonymous session identifier that only lives as long as the visit, keeps it in first-party sessionStorage, and clears it when the tab closes. No identifier survives into the next day, so there is nothing to consent to and nothing to recognise a person across sites.

What you can still measure

• Pageviews, unique visits and sessions per day, week or range.
• Referrers, channels and UTM-tagged campaigns — the full campaign taxonomy survives.
• Landing pages and exit paths within a session.
• Country and device class, resolved at the edge from the request itself.
• Custom events such as signup clicks or pricing views.
• Lead capture, as long as the lead call carries its own consent basis.

What you lose, honestly

Three things get harder without cookies, and pretending otherwise is how analytics tools end up overclaiming.

1. 1.Cross-session history. If someone visits on Monday and returns on Thursday, cookie-free tracking sees two separate sessions unless they identify themselves by submitting a form. Your returning-visitor metric will read lower than a cookie-based tool.
2. 2.Cross-device journeys. Phone in the morning, laptop at night, is two visitors. Only an identified lead joins them.
3. 3.Long attribution windows. A 90-day click window is a cookie concept. Cookie-free attribution lives inside a session plus whatever you store on the lead at conversion time.

None of that prevents the question most teams are actually asking: which campaign produced this lead? The answer lives in first touch and last touch, both captured during the session, and both attached to the lead when the form is submitted.

How the session model works in practice

A visitor lands on your pricing page from a LinkedIn post tagged with a UTM campaign. The tracker stores the first touch — source, medium, campaign, landing page — in sessionStorage. They browse two more pages, then submit a form. The lead call reads that stored context and writes it into the lead record permanently.

beacon.lead({
  email: 'ada@example.com',
  value: 2400,
  plan: 'growth',
})

The lead keeps the source and landing page even after the session ends, because it is stored in your database rather than reconstructed from a browser identifier later. That is the part most pageview-only tools cannot do.

Is dropping the banner the right call for you?

If your site is a marketing site whose job is to generate leads, cookie-free analytics plus a consent banner only on your actual form tooling is usually the best trade. You keep clean traffic data, you stop burning conversions on a banner that guards a pageview counter, and you still ask for consent where you genuinely process personal data.

If you run a logged-in product and need cohort retention, session replay or multi-touch revenue models, cookieless pageview tracking will not answer those questions. Use it for acquisition, and keep product analytics separate.