What “cookie-free analytics” actually means

The answer explains why one tool's visitor count won't match another's, and where the privacy really comes from. It isn't where most people assume.

What the cookie was doing

Analytics has one hard problem: telling visitors apart. Ten page views could be ten people, or one person clicking around. To know which, a tool has to recognise a browser it has seen before.

A cookie solves that by leaving a name tag on the visitor's device. The most widely used analytics tool, for instance, sets one cookie to tell visitors apart and a second for sessions, and keeps each for two years. Come back next month and the tag is still there, so you're the same "user". That makes counting easy. It's also what makes it tracking: a lasting identifier on someone's device that recognises them again and again.

Take the name tag away and you need another way to tell visitors apart for a while, with no way to recognise them later.

How Nodium tells visitors apart

When someone opens a page, Nodium makes a key from four things:

1. a random value, made fresh for each day (we call it the salt);
2. the network address the visit came from;
3. the browser's description of itself (the "user agent"), which names the browser, its version and the operating system;
4. your site.

Those four go through SHA-256, a one-way function. Out comes a long string that looks like noise. Visits with the same key on the same day are the same visitor, and that's all the key is for.

The key changes every day. The salt is new at midnight in your site's time zone, so tomorrow the same person on the same phone gets a completely different key. Nothing links the two.

The key is different on every site. Your site is part of the recipe, so someone who visits two sites that both use Nodium gets two unrelated keys. Nobody, us included, can follow a person from one site to the next.

The address is used, then dropped. It goes into the key and is never stored in our database, on its own or anywhere else in what we keep about a visit.

Where the privacy actually comes from

"It's hashed, so it's anonymous" isn't true on its own.

A hash can't be run backwards. But there are only about 4.3 billion IPv4 addresses, and browser descriptions are far from unique. Someone holding the day's salt and a visitor's key could, in principle, guess an address and a browser, run the recipe, and see whether the result matches. With enough computing power, they could try a lot of guesses.

The real protection isn't the hash. It's the salt. It's random, so it can't be predicted. It's made by us and never leaves our systems. And it's deleted the day after its day. Once it's gone, a key is just noise, and nobody can test a guess against it, us included. The keys stay with the raw visit records for 90 days, but for all but the first day or two of that time, nothing can link them to anyone.

Other privacy-focused tools work the same broad way, with a salt that lasts about a day.

What this does to your numbers

A cookie-free visitor is one device on one day. Strictly, it's one network address and one browser on one day.

Someone who comes back tomorrow counts again. Visit on Monday, come back on Thursday, and you're two visitors that week. A period's visitors are the sum of its days. So a 30-day visitor count in Nodium is closer to "visitor-days" than to "people". A sum of days runs higher than a count of distinct people over the same month, so don't expect it to match a cookie-based tool's count of users.

A phone that changes networks becomes someone new. Walk out of the house and your phone moves from Wi-Fi to mobile data. That's a new address, so a new key and a new visitor. A browser that updates itself mid-day does the same, because its description changes.

People who share a network and a browser can merge. Two people in the same office, on the same Wi-Fi, with the same version of the same browser on the same system, look identical and count as one.

We don't know a fair way to measure how often each of these happens on your site. So rather than pretend they cancel out, we say what the number is. On our How we count page, the definition reads:

One device on one day, counted without cookies: an anonymous key made from that day's random salt, the device's IP address and browser, and your site. The key changes at your site's midnight and the IP address is never stored, so someone who comes back tomorrow counts again. A period's visitors are the sum of its days.

Nothing on the visitor's device

The stricter rule behind "no cookies" is this: Nodium's script stores nothing on the visitor's device. No cookies, no local storage, no session storage, nothing that outlives the page.

That rule has a cost, and excluding your own visits shows it. Every analytics tool lets you leave yourself out, so checking your own site doesn't pad your numbers. The usual way is a cookie in your browser that says "don't count me". We can't do that without breaking our own rule. Our WordPress plugin runs on your server, so it can skip you while you're signed in to WordPress. Anywhere else, you exclude your visits by your network address: you type it into your site's settings, and visits from it aren't counted. That's less convenient, and it keeps the rule.

A few more things the script leaves behind:

• Query strings. We keep the page's path and drop everything after the ?, apart from campaign tags (the utm_ values, ref and source). Ad-click IDs and anything else in the address stay behind.
• Referrers. When someone arrives from another site, we keep that site's name, not the address of the page they came from.
• People who said no. If a browser sends Do Not Track or Global Privacy Control, the script sends nothing at all.

The one cookie Nodium sets is yours, as the owner. It keeps you signed in to your dashboard on usenodium.com. Your visitors never get it.

How long anything is kept

• Each page view, click and form step: 90 days, then deleted.
• Daily totals for your site, with no keys and no addresses in them: 3 years.
• The day's salt: deleted the day after its day.

Do you need a cookie banner?

Nodium sets no cookies, so it adds no banner to your site. Whether your site needs one at all depends on everything else on your pages, and on where your visitors are. Ad pixels, embedded videos, chat widgets and maps often set cookies of their own. And in the EU and the UK, the rules cover storing or reading anything on a device, not just cookies. Our plain-English guide sets out the rules in the US, the UK and the EU, with its sources. Whether counting without cookies needs consent where your visitors are is a legal question for you and your adviser, and we'd rather say so than guess.

The trade

Cookie-free analytics gives up one thing: recognising the same person over time. You won't see that a visitor came back three times before getting in touch, or how many people return each month. In exchange, nobody is recognised. There's no tag on anyone's device, no record of any visitor's address, and nothing that follows a person from your site to the next.

You want to know how many people came, where from, what they read, and whether they got in touch. You don't need to know who they were.