How to count unique visitors without cookies

Counting page views is easy: every request to a page is one. Counting visitors is the hard part, because the web has no built-in notion of “the same person again”. The usual answer is a cookie with a random ID. In the EU that answer comes with a consent banner, and a banner means you only count the people who click “accept”.

There is another way, used by Plausible and by datalove: recognise a visitor for one day only, from what every request already carries, and forget them at midnight.

The daily salted hash

Every request to your server arrives with two things: the network address it came from and the browser’s user agent (for example Mozilla/5.0 (Macintosh; …) Safari/…). Together they are fairly specific, but not specific enough to follow a person around, and neither is a secret you may keep forever. So they are never stored. Instead the server computes:

visitor id = SHA-256( today's salt + site + address + user agent )

The salt is a long random value, made fresh every day and deleted the next. That one detail does all the work:

• Two page views from the same browser on the same day produce the same visitor id, so they count as one visitor.
• Without the salt, nobody can compute the id back from an address, and nobody can test whether a given address visited.
• Tomorrow the salt is new, so the same browser gets a different id. There is nothing that links Monday’s visitor to Tuesday’s.

Nothing is written to the visitor’s device: no cookie, no local storage, no fingerprinting script. The address is used in memory to compute the hash and is then gone.

Visits, bounces and time on site

Once views of a day carry a visitor id, the familiar website numbers follow:

• A visit is a run of page views by the same visitor with less than 30 minutes between them. A visitor who reads three pages at lunch and one in the evening made two visits.
• The bounce rate is the share of visits with a single page view.
• Visit duration is the time from a visit’s first view to its last. A visit with one view lasts zero seconds, which is why the average is a floor, not a stopwatch.
• The entry page, referring site and campaign of a visit are those of its first view. A link from a newsletter brings a visit; the pages read after it do not carry the newsletter along.

An invented example: a visitor arrives from a search at 12:00 on the home page, opens pricing at 12:05 and the documentation at 12:50. That is one visitor, two visits (45 minutes passed), one of them a bounce, five minutes on site in the first.

Why no consent banner is needed

In Germany the consent requirement for cookies and similar techniques comes from §25 TDDDG (the national version of the EU ePrivacy rule). It is about storing information on, or reading it from, the user’s device. A server that reads the address and user agent it was sent anyway, and stores nothing on the device, does not fall under it.

What remains is the GDPR: the address is personal data for the moment it is used. The usual basis is legitimate interest (Art. 6 (1) (f)): knowing how many people read which page is a reasonable interest, and a hash that cannot be reversed or linked across days keeps the intrusion small. The privacy notice has to say what is done, and people can object.

This is the reading that cookieless tools and most German privacy advisors work with. It is not legal advice; if you process anything beyond this, ask yours.

What it does not measure

Be clear about the limits before you read the numbers:

• Returning visitors. Someone who comes back tomorrow is a new visitor. “Unique visitors in a month” is therefore the sum of daily visitors, higher than the number of people.
• The same person on two devices is two visitors, and several people behind one office address with the same browser version can be counted as one.
• A visit that leads to a sign-up days later cannot be tied to its referrer. Campaigns are compared by the visits and sign-ups they bring in the same period, not per person.

For a public website that is usually the right trade: numbers that include everybody, instead of precise numbers about the minority that accepts a banner.

Where the visitor recognition stops

Inside your product the picture is different. People sign in, so they are known by their account, and there is no need to guess from addresses at all. That is where account-first analytics takes over: the website shows how many people came and from where, the product shows which accounts then used what.