How Cookieless Analytics Counts Visitors
Privacy-first analytics tools count traffic without setting cookies. This sounds tricky — how can you tell if two pageviews belong together if you cannot identify people? There are two common approaches — and Antlytics now uses both, as separate KPIs.
What "unique visitor" means without cookies
In cookie-based analytics, a unique visitor is an individual identified by a persistent cookie. Return tomorrow, and the tool recognises the same cookie and counts you as a returning visitor.
Without cookies, products redefine the metric. The honest ones document that trade-off clearly.
Unique visitors: daily salted hash
Like Plausible and Umami, Antlytics estimates Unique visitors with a server-side HMAC of IP address + User-Agent + site + a daily UTC salt. The raw IP is discarded after hashing. Same person on multiple devices, or after the salt rotates, counts as a new visitor. That is intentional privacy design — not a bug.
Visits: tab-scoped sessions
Visits (also called sessions in APIs for compatibility) are distinct tab-scoped session_id values from sessionStorage, with a 30-minute idle timeout. A new tab gets a new visit; closing the tab ends it; returning after 30 minutes of idle time starts a fresh visit.
Pageviews are a separate count: every tracked navigation. The Overview traffic chart and top-pages table show pageviews — not visits.
Why counts differ from Google Analytics
If you run Antlytics and Google Analytics side by side, totals will differ. This is expected.
GA uses persistent cookies, so it can de-duplicate returning users across days. Antlytics’ unique-visitor hash rotates daily and does not create a long-lived identity. GA may also lose visitors who decline a consent banner; Antlytics’ cookieless script typically does not need a consent banner for analytics alone (confirm for your jurisdiction).
Neither count is universally “right” — they measure different things.
sessionStorage for visits
Within a single tab, Antlytics stores a UUID in sessionStorage when a visitor first arrives. That ID:
- Links pageviews within the same tab into one visit
- Powers bounce rate and visit-based metrics
- Clears when the tab closes (or after 30 minutes idle)
- Is not shared between tabs
This is not a cookie. sessionStorage is local to a single tab and clears at the end of the browsing session.
FAQ
Is cookieless counting less accurate? It is different. You lose long-lived return-visitor identity. You gain a simpler privacy model and usually fuller coverage where consent banners would have blocked cookies.
Why do my numbers look higher than GA? Often because Antlytics still records people who would have declined a cookie banner — and because Visits ≠ GA Users, and Unique visitors ≠ GA Users.
Does Antlytics use a daily visitor hash today? Yes. Overview shows Unique visitors (daily salted hash) alongside Visits (sessionStorage + idle timeout). See the dashboard overview and metrics contract.
Does every privacy-first tool use the same method? No. Hash-based unique visitors and tab-scoped visits are both common. Read each product’s metrics definitions before comparing dashboards.