Cookieless analytics

The law does not talk about cookies

Article 5(3) of the ePrivacy Directive talks about storing information on terminal equipment and gaining access to information already stored there. It names no technology. Cookies, localStorage, sessionStorage, IndexedDB and a cache entry are all covered equally, because all of them are writing to someone else device.

How to check it yourself, in thirty seconds

You do not have to trust any vendor, us included. Open your site, open the browser developer tools and go to the storage tab. You will see everything the page has written, grouped by kind.

1. Open the site in a private window so you start from empty storage.
2. Press F12 and go to the Application tab in Chrome or Storage in Firefox.
3. Look through Cookies, Local Storage and Session Storage for your domain.
4. Click through a few pages and check again, because some tools write only on the second pageview.

If after all that there is nothing in storage that your own application did not put there, the analytics tool really does write nothing. If there is an identifier, which drawer it sits in makes no difference.

Recognising a visitor without storing anything

With no identifier on the device, it has to be produced on the server, and from material the browser sends to every site anyway. We compute it like this: a cryptographic hash of the site id, the truncated network address and the browser header, signed with a random salt for that day.

• the salt changes at UTC midnight and its row is deleted after two days, so yesterday pseudonym cannot be matched to today one, not even by us
• the site id goes into the hash, so the same person on two measured sites gets two different pseudonyms
• the address is truncated before use: IPv4 loses its last octet, IPv6 is cut to /48
• we store eight bytes of the result and nothing else

What you will not see because of it

This is a price, not a missing feature, and every tool without a persistent identifier pays it. Worth knowing before you switch rather than after the first report.

Funnels within a single visit work normally, because the session identifier lives as long as the visit. What disappears is only what needs a memory longer than a day.

There is a side effect in the other direction too: the visitor count usually comes out lower than in a cookie based tool, because returning people are counted twice and several people behind one connection merge into one. It is an estimate that errs in a known direction, and that is how the dashboard describes it.