What exactly is one visitor

The conversation always goes the same way. Somebody installs a second analytics tool alongside the first, looks at the two numbers and asks which one is lying. The answer is: neither. Both are computed correctly; they are counting different things, because a "visitor" is not a physical quantity you measure but a definition you adopt.

That sounds like an evasion until you see how many decisions stand between raw HTTP requests and the sentence "we had 1,240 people yesterday". Every one of those decisions is arbitrary, every one has a sensible justification, and every one changes the answer.

From request to person: four decisions

A server sees requests. Turning those into "visitors" means climbing four levels of abstraction, losing something at each.

The last row is the interesting one, because that is where the rest of the differences hide.

The session, or thirty minutes from nowhere

Google Analytics 4 ends a session after thirty minutes of inactivity, as do most tools. Thirty minutes comes from no study of human behaviour. It is a value inherited from earlier systems that stuck through repetition.

The consequences are sometimes comic. Somebody reading a long article for forty minutes without clicking gets a second session halfway through, having gone nowhere. Somebody who left a tab open and came back after lunch counts as two visits. Then there is midnight: some tools cut sessions at the day boundary, and the day is defined by a time zone somebody set in the panel once and nobody remembers. A shop serving Poland with its property set to a US time zone has a daily report shifted several hours from its own sales.

Bounce, or one word with three meanings

The clearest example of how far definitions can drift is bounce rate. The same word in the same reports means something different today than it did five years ago.

The classic Universal Analytics definition: a session with one page view and no further interaction. Simple, with a flaw visible on any blog. Somebody arrives, reads for eight minutes, gets the answer they came for and leaves satisfied. That is a bounce. Content success recorded as failure.

GA4 inverted the concept. It introduced the engaged session, meaning one that lasts longer than 10 seconds, has a key event, or has at least two page views. Bounce rate in GA4 is simply the share of sessions that were not engaged. Same name, entirely different number.

Recognising a person, the hardest part

That leaves the hardest question: how does a tool know today's visitor is the same human as yesterday's. There are three approaches and each trades something away.

A persistent identifier in a cookie

The classic: a random identifier stored on the device, valid for months. It allows recognising returns over long periods and building cohorts. It costs consent, being a write to somebody else's device, and it works less and less well technically. Safari deletes script-written storage after seven days without interaction with the site, so "returning after a month" is a new visitor there regardless of what the tool intended.

Browser fingerprinting

Recognition from a set of device characteristics: fonts, resolution, graphics card, plugin list. It writes nothing, so it sidesteps Article 5(3) of the ePrivacy Directive. It is also considerably more invasive than a cookie, because it works without the user's knowledge and cannot be cleared, and browsers actively fight it, which makes it unreliable as well.

A daily fingerprint with a rotating salt

The third approach, chosen by most tools describing themselves as cookieless, ourselves included. The identifier is a hash of the IP address, the user agent, the site domain and a random salt changed every day. Nothing lands on the device, and the identifier stops working when the salt rotates.

The essential point is that salt rotation is not a limitation to work around; it is the whole design. The old salt is deleted, so yesterday's identifiers cannot be reconstructed even with full access to the database. The price is a hard daily boundary: the same human tomorrow is a new visitor.

What you genuinely lose this way

Honesty requires listing the losses, not just the benefits. Without a persistent identifier you cannot measure:

• long-term returns: how many January readers came back in March,
• cohorts and lifetime value: month-by-month retention needs identity held for months,
• full multi-touch paths: who saw the ad on Monday and bought on Thursday,
• cross-device stitching: one person's phone and laptop will always be two visitors.

Those are real losses and decisive for some businesses. A shop building a loyalty programme needs identity, but it should take it from the user account, where there is informed consent and an explicit purpose, rather than from a cookie attached to every passing visitor.

It is worth noticing what is not on that list. Daily and monthly traffic, sources and channels, page popularity, entry and exit paths, conversions, funnels, geography, devices, performance. That is the overwhelming majority of what anybody actually looks at, and all of it works without recognising people across days.

Why two tools will never agree

Back to the opening question: the gap between two tools on one site is the sum of small discrepancies, none of them large on its own.

• a different visitor definition, meaning a different memory horizon,
• a different moment of sending the event: on document load or after the script runs,
• different bot lists, and bots can be a third of raw traffic,
• different handling of URL changes in single-page apps,
• a different time zone configured in the panel,
• different sampling thresholds at high volume,
• different collapsing of rare values into a catch-all row.

A gap of ten to twenty percent between two correctly functioning tools is normal, not a symptom of failure. Hunting for the culprit is wasted time.

Questions worth asking your own tool

Whatever you use, it pays to know the answers to five questions. All are in the documentation, none requires talking to a salesperson, and without them you are reading the report on instinct.

1. After how many idle minutes does a session end, and is it cut at midnight?
2. For how long does the tool recognise the same visitor, and on what basis?
3. What exactly counts as a bounce?
4. Which time zone is configured, and does it match the one the business runs on?
5. Does sampling kick in at high traffic, and above what threshold?

A visitor is not a fact but a convention. There is nothing wrong with that, as long as you know which convention. The trouble starts when somebody treats a number in a report like a temperature reading and builds on it a conclusion the definition cannot carry.