[{"data":1,"prerenderedAt":115},["ShallowReactive",2],{"blog-\u002Fblog\u002Fcookieless-vs-cookie-based-analytics":3},{"id":4,"title":5,"author":6,"body":7,"category":96,"date":97,"description":98,"excerpt":88,"extension":99,"image":100,"meta":101,"navigation":109,"path":110,"readTime":111,"seo":112,"stem":113,"__hash__":114},"blog\u002Fblog\u002Fcookieless-vs-cookie-based-analytics.md","Cookieless vs Cookie-Based Analytics: The Trade-Offs Explained","Ilias Benaissa",{"type":8,"value":9,"toc":87},"minimark",[10,14,19,22,25,28,31,34,38,41,44,48,51,54,57,61,64,71,74,78,81,84],[11,12,13],"p",{},"A lot of teams see cookieless analytics as a compliance upgrade, where you install a new tool, remove the consent banner and you are done. In practice it is a bit more complicated than that, and it helps to know where the differences are before you decide how you want to measure.",[15,16,18],"h2",{"id":17},"how-cookie-based-analytics-works","How cookie-based analytics works",[11,20,21],{},"Cookie-based analytics stores an identifier in the visitor's browser that stays there for days or even months. That way you can see when someone comes back and what they did over several visits. The compliance side, however, is where most of the work is.",[11,23,24],{},"The rules come from the ePrivacy Directive, the European law behind every cookie banner. If you want to store something on a visitor's device or read something from it, you need their consent first, unless it is strictly necessary for your website to work. Analytics does not count as that, although France and the Netherlands make an exception for analytics with very little privacy impact, under strict conditions.",[11,26,27],{},"In 2019 the European Court of Justice made consent a lot stricter in the Planet49 ruling. Consent has to be an active choice, so a pre-ticked checkbox does not count, and this applies to every cookie, even when it does not contain any personal data.",[11,29,30],{},"In 2023 the European privacy authorities also looked at the cookie banner itself. The vast majority agreed that a banner with an accept button but no way to reject is not allowed, and some, like the French CNIL, want the reject button right on the first screen.",[11,32,33],{},"These rules are also being enforced. The large fines against companies like Google make the news, but the rules apply to every website, regardless of the size of the company behind it. Privacy authorities across the EU check smaller websites too, and complaints can come from anyone: a visitor, a competitor or a privacy organisation. For a small business a fine will usually be a lot lower than for Google, but a complaint still costs time, money and, most importantly, trust.",[15,35,37],{"id":36},"how-cookieless-analytics-works","How cookieless analytics works",[11,39,40],{},"Cookieless analytics does not store anything in the browser. Instead a short-lived identifier is calculated on the server before the data is stored. In Otus this identifier is based on part of the IP address, the user agent and the browser language, which the browser sends along with every request anyway.",[11,42,43],{},"The identifier changes every day, so a visitor cannot be recognised the next day. The IP address is used to look up the country and to calculate the identifier, and is thrown away right after, so it is never stored.",[15,45,47],{"id":46},"cookieless-does-not-automatically-mean-consent-free","Cookieless does not automatically mean consent-free",[11,49,50],{},"Leaving out cookies does not settle the question on its own. The European privacy authorities have made clear that the consent rules also cover other ways of recognising visitors, including tracking based on IP addresses. What matters is how a tool recognises visitors, not whether it uses cookies.",[11,52,53],{},"How this works out in practice depends on the country, because each country applies the rules in its own way. Germany and the Netherlands are a good example of how different that can be. The German authorities distinguish between information the browser sends along by itself, like the IP address, the user agent and the language setting, and information a script actively reads from the device. Only the second requires consent. The Netherlands takes a different route: there is an exemption for analytics that has little or no impact on the privacy of visitors, under strict conditions.",[11,55,56],{},"The Otus identifier only uses what the browser sends along by itself, so in a country with guidance like Germany's, cookieless mode does not need a consent banner. In other countries the answer depends on local rules, so check the guidance of the privacy authority in the countries your website targets. Wherever you are, you still need a legal basis under the GDPR, which for most websites is legitimate interest, and you should mention Otus in your privacy policy.",[15,58,60],{"id":59},"the-effect-on-data-quality","The effect on data quality",[11,62,63],{},"With cookieless analytics compliance gets simpler, but your data gets less detailed. A returning visitor is counted as new once the identifier has changed, you cannot follow someone over several visits, and cross-domain attribution is not possible. For most content websites and marketing pages that is fine, but for a webshop where people take a few weeks to decide, you will miss part of the picture.",[11,65,66],{},[67,68],"img",{"alt":69,"src":70},"cookie-vs-cookieless-over-time","\u002Fimages\u002Fblog-posts\u002Fcookieless-vs-cookie-based-analytics\u002Fcookieless-vs-cookie-based-analytics.png",[11,72,73],{},"On the other hand, cookie-based data only covers the visitors who accepted cookies, and in practice that is never everyone. Cookieless analytics measures almost all visitors, apart from those who block analytics altogether.",[15,75,77],{"id":76},"you-do-not-have-to-choose","You do not have to choose",[11,79,80],{},"With most setups you are stuck with one of the two. With Otus you can start in cookieless mode and switch to full tracking mode whenever you want more detail and have your consent setup in place.",[11,82,83],{},"In full tracking mode you get the full customer journey for every visitor who consents, including returning visits and journeys over several days. For visitors who decline, you decide whether Otus falls back to cookieless measurement, without anything stored on their device, so you still have session-level metrics for your whole website.",[11,85,86],{},"Only use that fallback if it is allowed in the countries your website targets, and make sure your consent banner and privacy policy clearly explain what happens when visitors decline. Whether you turn it on is your choice, and we would rather you make it deliberately than by default.",{"title":88,"searchDepth":89,"depth":89,"links":90},"",2,[91,92,93,94,95],{"id":17,"depth":89,"text":18},{"id":36,"depth":89,"text":37},{"id":46,"depth":89,"text":47},{"id":59,"depth":89,"text":60},{"id":76,"depth":89,"text":77},"Privacy","2026-10-07","Cookieless analytics is not automatically consent-free, and cookies are not automatically a problem. What each gives you, and why you don't have to pick.","md","\u002Fimages\u002Fblog-posts\u002Fcookieless-vs-cookie-based-analytics\u002Fcover.png",{"primary_keyword":102,"keywords":103},"cookieless analytics",[104,105,106,107,108],"cookie-based analytics GDPR","ePrivacy Directive compliance","privacy-first analytics","analytics data quality","EDPB consent requirements",true,"\u002Fblog\u002Fcookieless-vs-cookie-based-analytics",6,{"title":5,"description":98},"blog\u002Fcookieless-vs-cookie-based-analytics","Nn6BADeHJawZihpbgGfsnRrGc9z1dPLniMr0R-l4kf8",1791983678776]