Privacy-First Analytics: Tracking With Zero Cookies

The banner is not the real problem

Every small business owner has met the modal. The page has finished loading, and then a box covers half the screen explaining that the site shares data with a long list of advertising partners and asking you to choose.

The instinct is to blame the box. But the box is only there because something on the page is asking for information about the visitor, and that something is nearly always a script loaded from somebody else’s domain. The box is the visible cost. The invisible one is that script.

Three things happen when it arrives. It is downloaded, which competes with your images. It is parsed and executed, which happens on the same thread your visitor’s finger is trying to use when they tap the menu. And it very often shifts the page as it settles, which moves the button they were aiming at.

None of that is a theory you have to take on trust. You can see all of it on your own site in about five minutes.

Five minutes to see what your site loads

1. Run your address through Google’s PageSpeed Insights. It is free and it runs against your live page. It reports how long the page takes to show its main content, how long the page is unresponsive when someone taps it, and how much the layout moves as it loads. Google publishes the thresholds it measures against on web.dev: an interaction should respond within 200 milliseconds, and the page should not shift more than 0.1 as it loads.
2. Open the browser’s Network panel and reload your page. Sort by size. The list of domains is the answer: every domain that is not yours is a company your visitor’s browser is talking to on your behalf.
3. Look at the main thread. In the Performance panel, the main thread chart shows the long tasks. Third-party scripts show up as coloured bars you did not write.
4. Read what the banner says. It usually names the tools. Write them down. That list is the list of things running on your visitors’ phones.

Now you have facts about your own site, which is worth more than any general claim about what tracking scripts cost.

What cookies are actually for

The reason a site asks for consent is not the counting. It is the identity.

A cookie is a small file your browser keeps, and its real job is to let the analytics tool know that Tuesday’s visit and Wednesday’s visit were the same person. With that, the tool can count returning visitors, attribute a sale to a campaign, and follow a path through the site. Without it, all you have is visits.

So a decision to drop cookies is a decision to give up those three things, and only those three things. Traffic counts, popular pages, referrers and rough unique-visitor-per-day numbers all survive.

That is a real trade, and for most small businesses the traffic side of it is the part they actually use.

What cookieless measurement is

The alternative is to do the counting on your side, where the request arrives anyway. The result is a zero-cookie measurement: nothing is written to the visitor’s device, and no script has to be downloaded before the count can happen.

┌──────────────────────────────────────────────────────────────────────────────┐
│  HOW A COOKIELESS COUNT WORKS                                                │
├──────────────────────────────────────────────────────────────────────────────┤
│  1. The visitor requests a page. The server sees the request, the path,      │
│     the time, the referring page and the browser details.                    │
│  2. The server combines those with a secret that changes every day and       │
│     stores only the resulting digest.                                        │
│  3. The count goes up. The visitor's browser stores nothing.                 │
├──────────────────────────────────────────────────────────────────────────────┤
│  BECAUSE THE SECRET CHANGES DAILY, DIGESTS FROM DIFFERENT DAYS CANNOT BE     │
│  MATCHED UP. THERE IS NO IDENTIFIER TO FOLLOW FROM ONE DAY TO THE NEXT.      │
└──────────────────────────────────────────────────────────────────────────────┘

Three practical consequences, and they are the whole case for it.

There is nothing to block. No script is loaded onto the page, so no ad-blocker can stop it and no visitor loses your statistics because they have an extension installed. That also means your numbers stop disagreeing with your server logs.

There is nothing to consent to for that measurement. No cookie, no identifier, no storage on the device. Whether you still need a banner depends on everything else you run, and on the rules that apply where your visitors are. The ICO’s guidance on data protection principles is the right starting point if you are not sure, and it is worth asking a lawyer rather than a blog, including this one.

Nothing runs on the visitor’s phone. No download, no parsing, no long task, no layout shift. Your own pages get the whole main thread.

What you give up

Honesty here matters more than enthusiasm.

• No individual journeys. You cannot watch one person move through your site. You know that three people read the pricing page, not which three.
• No returning-visitor number across days, unless you build something that tracks it, which is exactly the thing cookieless measurement avoids.
• No campaign attribution in the form advertising platforms sell. You can see that visits came from a search term, not which ad closed the sale.
• No session recordings. This is the one small business owners miss most, and it is worth being honest about: heatmaps and recordings are the main reason many owners keep a recording tool at all, and those tools need consent.

That last point is why this is a decision rather than an upgrade.

What this site does

Since this article is on a website, it is fair to say what we do here rather than only what we recommend.

This site loads Google Analytics 4 and Microsoft Clarity, and it asks first. If you accept, they load; if you decline, they do not load at all, and your choice is remembered so you are not asked again. If you change your mind, the privacy page has a button to change it, which removes the analytics cookies this site can reach and reloads the page. Form contents are masked in the session recordings.

We made that choice because the analytics and the recordings were already in place when the site was rebuilt, and because the recordings are genuinely useful for spotting where people get stuck. We are not going to pretend that makes a cookie banner free, or that consent is the only defensible choice. It is a deliberate one.

If you want to change what yours does

1. Write down what you run and why. Every tag, every pixel, every tool. Most owners cannot do this from memory, and the list is usually longer than expected.
2. Decide which numbers you actually look at. If you check one report a month and it is visits and traffic sources, you need a fraction of what you are running.
3. Move what you can to the server. Traffic counts, popular pages and referrers do not need a script in the browser.
4. If you keep browser tools, load them late and behind consent, and check that the consent state is respected on every page rather than only the one where the banner appears.
5. Write a privacy page that says what you load and when, in plain words, with a way to change your mind. A short honest page is better than a long generated one.

The measurement you use afterwards is the same either way. You still look at the same report, you just draw it from somewhere that does not cost your visitors their battery, their attention and their trust.

Want to check how your own site behaves? Read why a faster website means more enquiries, or look at the privacy page for exactly what this site loads.