How cookieless analytics counts visitors

Traditional analytics gives each visitor a cookie with a unique ID and recognises them on every visit for up to two years. Statsdot does not. Here is exactly how it counts instead.

What the page sends

When a page loads, the script sends one small message with:

• the address of the page, without the part after the ?;
• the website the visitor came from, only its domain;
• the UTM campaign tags in the link, if there are any;
• the width of the screen, to tell phones, tablets and computers apart.

It writes nothing on the device: no cookies, no local storage, no identifiers.

The daily code

The server receives the message together with the IP address and the browser name, as every web server does. It then:

1. takes a random secret key created for that day;
2. combines it with the site, the IP address and the browser, and runs it through a one-way hash;
3. keeps only the first part of the result, the visitor code, and discards the IP address.

The same visitor gets the same code all day, which is how we count unique visitors. The country comes from the network the request arrives through; the IP address itself is never written anywhere.

Why the key is deleted every day

At the end of the day the key is gone. Without it, the code cannot be calculated again, so nobody, including us, can link a code back to an IP address or recognise the same person tomorrow. Each day starts from zero.

What this means for your numbers

• A person who visits on Monday and Tuesday counts as two visitors. Over a month, "visitors" means visitor-days.
• A person on a phone and a laptop counts as two visitors.
• Visitors who reject cookie banners are still counted, because nothing here depends on cookies.

What we store

The page, the referring domain, campaign tags, the visitor code, country, device type, browser, operating system and the time. Never the IP address, the full browser string, the full referring address or anything typed into a form.