How cookieless tracking works
In cookieless mode — the default for every site — a visitor is identified by a daily-rotating salted hash derived from request signals. No cookie is set, nothing is written to local storage, and no cross-day profile is kept. Because the salt rotates every day, the identifier can’t be used to follow someone from one day to the next. The trade-off is simple: a visitor who returns tomorrow is counted as new, since yesterday’s identifier no longer exists.Why no consent banner is needed
GDPR and the ePrivacy Directive require a cookie consent banner when you store or read information on a visitor’s device — chiefly, cookies used to identify people over time. Cookieless mode does neither: it sets no cookie, stores no device identifier, and builds no persistent cross-day profile. With nothing stored on the device and no long-term identifier, the usual basis for a cookie consent prompt for analytics doesn’t apply. This is the right default for most marketing sites: accurate traffic measurement without interrupting visitors or maintaining consent infrastructure. As always, this is a description of how the product works, not legal advice — confirm your own obligations for your jurisdiction and use case.Cookie mode and its trade-off
When cross-day identity genuinely matters — accurate returning-visitor counts, multi-day retention cohorts — you can switch a site to cookie mode. In cookie mode the tracker sets a first-party visitor id so the same person is recognized across days and sessions.
The cost of cookie mode is that you’re now setting a first-party cookie, which brings the usual consent considerations back into scope. Reach for it only when you rely on cross-day continuity.