# Cookieless mode

Track without storing anything in your visitors' browsers — how it works, what you give up, and when you still need a consent banner.

VisitTrack has two tracking modes. **Standard** (the default) keeps an anonymous visitor id in a first-party cookie, so the same person is recognised across days. **Cookieless** stores nothing on the visitor's device at all.

## Turn it on

- For the whole site: **Settings → General → Tracking mode**, or tick **Use cookieless tracking script** during install. This is enforced on our servers, so it applies to every script tag on the site — even ones installed without the attribute.
- Per script tag: add `data-cookieless`. Useful if only some of your pages need it.

```
<script defer data-site="YOUR_SITE_ID" data-cookieless src="https://visitrack.app/tracker.js"></script>
```

## How it works

In cookieless mode the script never writes a cookie, localStorage or sessionStorage entry for a visitor id (and clears the standard-mode ones if they exist). Instead, our server derives a visitor id from a one-way hash of the site, the visitor's IP address and user agent, and a secret salt that changes every day (UTC). The IP and user agent only feed the hash and are never stored, and because the salt changes daily, the same browser gets a new, unrelated id each day — visits on different days aren't linked.

## What you give up

|  | Standard | Cookieless |
| --- | --- | --- |
| Pageviews, sources, pages, countries, devices | Full | Full |
| Unique visitors within a day | Full | Full (people sharing an IP and browser can merge) |
| Returning visitors, retention | Full | Limited — anyone returning after 24h counts as new |
| Users and Journeys tabs | Full history | Limited to a single day |
| Revenue attribution | Works across days | Only when the payment happens within the same 24h window |
| Cross-domain tracking | Supported | Not available |
| Custom events, goals, funnels, Web Vitals | Full | Full |

Users, Journeys and Retention show a notice while a site is cookieless, so nobody reads a shortened history as a real drop.

## Do you need a consent banner?

This is general information, not legal advice — check with your own counsel for your situation.

- **Standard mode** stores a persistent identifier on the visitor's device. In the EU and UK, the ePrivacy Directive (and national laws implementing it, like PECR) generally requires consent before storing or reading such an identifier unless it's strictly necessary for a service the user asked for — and analytics usually isn't. Some regulators (e.g. France's CNIL) allow narrow audience-measurement exemptions, but you shouldn't assume one applies. Plan on a consent banner, or load the script only after consent.
- **Cookieless mode** stores and reads nothing on the device, which is what the ePrivacy consent rule is about, so it's designed to run without a cookie banner. GDPR still applies to the processing itself (the IP address is personal data while it's being hashed), so mention VisitTrack in your privacy policy.
- Outside the EU/UK, rules differ; standard mode is typically fine with a privacy-policy disclosure.

> **A good default** — If you already show a consent banner, keep standard mode and load the script after consent — you get the most accurate data. If you don't want a banner at all, use cookieless mode.