Some time ago we wrote about why we ship our own cookie consent on every project we build. The short version: if a site stores anything on a visitor's device, that visitor deserves a clear and honest choice, and we would rather build that choice properly than bolt a banner on top. That article left a question hanging, and clients ask it often enough that it deserves its own answer. If you take consent that seriously, what do you do about analytics?
Our answer was to build our own analytics product, and to build it so the question never comes up. It uses no cookies. It stores nothing on the visitor's device. It builds no profile of any individual person. And it still answers the questions a business owner actually has about their website, which turn out to be different questions than the analytics industry has trained everyone to ask.
This is the follow-up piece: what cookieless analytics looks like in practice, what it can and cannot tell you, and why we have come to see privacy not as a sacrifice you make for compliance, but as a genuinely simpler way to run a website.
The questions that actually matter
When we sit down with the owner of a small or mid-sized business and ask what they want to know about their website, the list is remarkably consistent. Is the site growing or shrinking? Which pages and articles do people actually read? Where do visitors come from, both in the sense of geography and in the sense of which search engines, campaigns, or referring sites send them? And did the thing we did last month, the campaign, the redesign, the new service page, make any difference?
Notice what is not on the list. Nobody asks to follow one specific visitor across the web. Nobody asks what a particular person did on their third visit. Those capabilities exist in mainstream analytics tools because advertising platforms need them, not because a business owner asked for them. Every question on the real list can be answered with honest counting, and honest counting does not require identifying anyone.
How analytics works without cookies
Traditional analytics works by labeling each visitor with an identifier, storing it in a cookie, and stitching their actions together into a profile over time. Our approach skips the labeling step entirely. When a page is viewed, the visit is counted, a handful of non-identifying attributes are noted, and the event is folded into aggregated rollups: this page, this day, this many views, this many visits, these referrers, these countries.
The result is a dashboard that speaks in totals and trends rather than individuals. You can see that an article took off this week, that search traffic has grown steadily since spring, that the pricing page gets read mostly on weekdays. What you cannot do, and what we cannot do either, is point at any row of data and say it belongs to a particular human being. The data is born aggregated. There is no personal layer underneath it to leak, to hand over, or to worry about.
Realtime without surveillance
There is one moment when totals per day are not enough: the day something happens. You send a newsletter, a post gets shared somewhere, a campaign goes live, and you want to watch the response as it arrives. So alongside the daily rollups there is a realtime view, and it follows the same principle as everything else. It shows activity, not people: how many visits right now, on which pages, arriving from where. And when the moment passes, the moment passes: nothing has been remembered about any individual, and the daily rollups simply carry the totals forward. It is the difference between watching a crowd flow into a venue and photographing each face at the door. The first tells you the evening is going well. Only the second is surveillance.
Geography at a respectful granularity
Where visitors come from is one of the most genuinely useful things analytics can tell a business. It shows whether a site serving several markets is actually reaching them, whether translated content is being found by the audience it was written for, and whether attention from a new region is real or wishful. Our analytics answers this at the level of countries and regions, which is the level where business decisions are made. It does not pinpoint anyone. Knowing that interest from a neighboring country grew after you launched content in their language is strategy. Knowing which street someone browsed from is not, and no decision you will ever make requires it.
What we gave up on purpose
Honesty requires saying clearly what this approach does not do. It does not reconstruct an individual visitor's journey across weeks of visits. It does not build audiences for retargeting, so it will not help you show ads to people who visited yesterday. It does not feed advertising platforms that want a personal identifier to match against.
For some businesses, particularly those built on paid advertising at scale, those are real losses, and a mainstream tool may still earn its place with the consent obligations that come with it. But among the businesses we work with, those features mostly went unused, while what was being paid for them was very real: a heavier consent banner, more legal surface, and numbers that only counted the visitors who clicked accept. Giving up capabilities nobody used in exchange for shedding obligations everyone felt is a good trade, and it is one we made deliberately rather than by accident.
Privacy as a simpler life
Here is the part we did not fully anticipate: how much lighter everything becomes. With no analytics cookies, there is less for the consent banner to ask, and the analytics works for every visitor whether or not they interact with it, so the picture reflects everyone rather than a self-selected slice. There is no questionnaire about where personal data flows, because no personal data flows. When a thoughtful client, or their lawyer, asks what is collected about visitors, the answer fits in one sentence and does not need revisiting every time a regulation moves.
We think this is the direction the web is quietly heading, and we are comfortable being early. The businesses we work with want to know their website is working. They do not want to run a tracking operation on the side. It turns out you can have the first without the second, and once you have seen your own traffic through that lens, the old way starts to look like a lot of effort spent answering questions nobody was asking.