How Web Analytics Works Without Cookies, Consent or Per-User Tracking
Key Takeaways
- Cookie-based analytics fails at three structural levels: browsers block third-party cookies by default, GDPR consent means that, in our experience with clients, between 40% and 60% of traffic doesn't accept cookies, and ad blockers strip scripts from part of what is left.
- Cookieless analytics replaces cookies with first-party data collection through your own infrastructure — no third-party server, no blocked scripts, no consent dependency.
- Cookie-based tracking doesn't see part of your traffic, and how much depends on the store: at Incapto, measured on Shopify over 48 days, GA4 did not record 29% of visits; cookieless tracking does not depend on consent because there is no cookie to block, reject, or expire.
- Consent exemption is architectural, not a workaround — nothing that identifies anyone is kept and no cookies are stored, built around CNIL guidance (in Germany, where the DSK does not extend the exemption to audience measurement, this is our reading, not settled).
The cookie — the small text file that has powered web analytics since 1994 — is reaching the end of its useful life. Safari blocks third-party cookies by default. Firefox does the same. Chrome has restricted them. And GDPR consent requirements mean that a significant percentage of European visitors opt out of cookie-based tracking entirely.
For businesses that depend on web analytics for marketing decisions, this creates a fundamental problem: the tool you rely on to understand your traffic is increasingly blind to most of it.
Why cookies fail at measurement
Cookies were designed for session management — keeping users logged in, remembering shopping carts. Their use for analytics tracking was a later adaptation, and that adaptation relied on conditions that no longer exist:
- —Browsers accepted all cookies by default (they no longer do)
- —Users rarely cleared cookies (privacy features now do it automatically)
- —Ad blockers were uncommon (a sizeable share of users now run them, more on desktop)
- —Consent was not required (GDPR changed this in 2018)
The cumulative effect is large, and its size depends on the store and the channel, so there is no universal figure to quote. On Incapto's Shopify store, tracked side by side for 48 days, GA4 did not record 29% of visits. The data loss calculator gives an estimate for your specific traffic; measuring gives the real number.
How cookieless analytics works
Cookieless analytics replaces the cookie mechanism with first-party cookieless data collection. Instead of placing a cookie on the visitor’s browser and sending data to a third-party analytics server, the data collection happens through your own infrastructure.
The key differences:
| Aspect | Cookie-based (GA4) | Cookieless (Sealmetrics) |
|---|---|---|
| Data path | Browser → third-party server | Browser → your server (first-party) |
| Blocked by ad blockers | Yes (share varies by audience) | No (first-party requests) |
| Affected by consent | Yes (40–60% don't accept, in our experience with clients) | No (no cookies or PII) |
| Browser restrictions | ITP, ETP limit cookie life | Not applicable |
| Traffic captured | Consent-dependent | Not reduced by consent |
Privacy compliance without compromise
A common misconception is that cookieless analytics is a workaround to avoid consent requirements. It is not. The reason consent is not required is architectural: nothing that identifies anyone is kept, no cookies are stored on the visitor’s device, and reports are always aggregated.
This is consistent with the CNIL (French DPA) exemption criteria for audience measurement tools. In Germany the DSK does not extend the exemption to audience measurement, so there it is our reading, not a settled position. The security and privacy architecture page covers the regulatory alignment in detail.
What this means for your analytics
The transition from cookie-based to cookieless analytics is not a minor upgrade. It is a fundamental change in what you can measure. Attribution models that were unreliable on the consenting fraction of traffic become useful without consent gaps. Campaign optimization that was based on the cookie-accepting segment can now reflect actual visitor behavior.
The best way to understand the difference is to see it. Run a cookieless analytics tool alongside your current setup and compare the numbers. Learn how Sealmetrics works or see the full comparison with GA4.