Cookieless analytics and cookieless tracking cover every way of measuring traffic and attributing conversions without relying on consent-required cookies, starting with third-party cookies. Two very different routes exist: the regulatory exemption for strictly configured audience measurement (the CNIL exemption in France) and technical alternatives such as cookieless analytics tools, server-side tracking, first-party data, contextual targeting and modelling. No single option replaces everything cookies used to do: the right strategy combines several. This guide covers the options, their legal conditions, their real limits and how to build a strategy that holds up.
Why measuring without cookies has become essential
Browsers restrict third-party cookies. Safari and Firefox have blocked them by default for years. Chrome abandoned its plan to remove them and, in October 2025, Google retired most Privacy Sandbox APIs, including Topics and Protected Audience. Third-party cookies still work in Chrome by default, but a large share of your visitors browse in an environment where they do not.
Consent is required, and often refused. The GDPR and the ePrivacy Directive require prior consent for non-essential cookies. Refusal rates are high, especially when the banner offers a real "Reject" button, and many sites now measure only part of their traffic with their usual analytics.
Users protect themselves. Ad blockers and anti-tracking extensions further reduce the reliability of browser-side measurement.
What does "cookieless" actually mean?
Cookieless does not mean data-free, and it does not mean "no cookies at all". First-party cookies remain essential for sessions, carts or storing consent choices. The goal is to remove the dependence on third-party and consent-required trackers.
Removing the cookie does not remove the law. The ePrivacy rules cover any storage of or access to information on the visitor's device, not just cookies: localStorage, device fingerprinting and similar techniques fall under the same consent requirement. And if a tool processes personal data (IP address, identifiers, a hash that singles out a person), the GDPR applies. The real question is not "does it set a cookie?" but "does it read or write on the device, and can it identify someone?"
Two routes: exemption or alternative techniques
- The regulatory exemption: audience measurement tools configured strictly enough to run without consent. They may even use a first-party cookie, provided every condition is met.
- Cookieless alternatives: tools and techniques that measure without storing anything on the device (server logs, aggregated data, modelling) or that move collection to your server. Their conditions and precision vary widely.
The CNIL exemption for audience measurement
In France, the CNIL exempts audience measurement from consent (deliberation 2020-091) only if every condition is met:
- Purpose strictly limited to audience measurement, on behalf of the publisher exclusively.
- No cross-referencing with other processing, and no cross-site tracking.
- No transfer of the data to third parties.
- IP address anonymised before any processing.
- Tracker lifetime of 13 months maximum, data retained for 25 months maximum.
Visitors must still be informed (in your privacy policy) and be able to object. The exemption is a French rule: other supervisory authorities apply their own criteria, so check the position of the authority that covers your audience before removing the analytics consent.
Which tools qualify?
Matomo is the best-known tool, provided it runs in its exempt configuration: no cross-referencing, anonymised IP, data kept for the publisher only. In its standard configuration it is not exempt. The CNIL also references other solutions that can be configured to qualify. Google Analytics 4 does not meet these conditions in its default configuration, so it remains subject to consent: see whether Google Analytics is GDPR compliant. Our article on Matomo and the consent banner details the settings.
In FlowConsent, services eligible for this exemption carry a "CNIL exemption possible" legal basis, and the Builder displays the checklist above: see services and legal bases. The checklist is informative; checking your own analytics configuration remains your responsibility.
Cookieless analytics tools compared
These are the most widely used options. Check each vendor's current documentation and pricing, which change regularly.
Matomo
The most complete alternative to Google Analytics, self-hosted or in the cloud. It can run without cookies, and in its exempt configuration it qualifies for the CNIL exemption. Funnels, goals and e-commerce reports are available.
Plausible Analytics
A very lightweight script that sets no cookies and is designed not to collect personal data. Aggregated metrics: page views, traffic sources, country, device. No individual tracking. Ideal for brochure sites and blogs.
Fathom Analytics
Same principle as Plausible (lightweight script, no cookies), with custom event and e-commerce tracking. Clean interface, more limited integrations.
Simple Analytics
Aggregated page views and referrers only, no cookies and no fingerprinting. Simple, but limited for advanced needs.
Piwik PRO
An enterprise analytics suite with a built-in consent manager and tag manager. Offers a cookieless mode alongside funnels and advanced segmentation.
PostHog
An open-source product analytics platform (session recordings, feature flags, A/B testing) that can run without cookies. Product-oriented rather than marketing-oriented.
The trade-off is the same for all of them: no individual user tracking, limited segmentation and no multi-channel attribution. Before removing your banner, check that the tool is configured so that it neither stores anything on the device nor identifies visitors.
Other cookieless techniques
Server log analysis
Server access logs (Apache, Nginx) record every request without any cookie. They give overall traffic figures. Limits: hard to separate bots from humans, no in-page behaviour (scroll, clicks) and less precision than an analytics tool. Useful for simple sites or as a complement.
Server-side tracking
Server-side tracking moves collection from the browser to your server. It bypasses ad blockers, gives you full control over what is sent to third parties and improves conversion data quality. It does not remove the need for consent when personal data is processed: see our guide to server-side tagging and consent. Processing triggered from your server escapes any browser banner; FlowConsent's server SDK lets your backend respect the visitor's decision.
First-party data
Data collected directly from your users (newsletter sign-ups, accounts, purchase history) is the most reliable and durable. Advertising platforms offer matching based on hashed emails (Customer Match, Custom Audiences), which still requires a proper legal basis.
Contextual targeting
Ads are chosen according to the page content rather than the user's profile. Compliant by design, but no remarketing and no individual attribution.
Google Consent Mode v2 and conversion modelling
Google Consent Mode v2 adapts Google tags to the visitor's choice. In basic mode, tags do not load at all until consent. In advanced mode, tags send cookieless pings when consent is refused (gcs=G100), which feed Google's conversion modelling without writing cookies. This recovers part of the lost conversion data but does not replace full analytics. Read basic vs advanced mode, our Consent Mode v2 implementation guide and how FlowConsent implements Google Consent Mode: denied defaults before any tag, and cookieless pings recognised as compliant by its scans.
The limits of cookieless tracking
Cross-device tracking remains difficult. Without a shared identifier, linking a user's journey across devices relies on logged-in sessions or probabilistic modelling.
Remarketing changes shape. It now goes through conversion APIs, hashed email lists or lookalike audiences, with lower precision and reach.
Consent is still required for server-side tracking whenever personal data is processed. When choosing your CMP, check how it handles consent for server-side setups.
Fingerprinting is not an alternative. It is treated as a tracker under ePrivacy and the GDPR, requires consent, and browsers actively fight it.
Modelling needs volume. It shows trends but does not replace individual conversion data on small volumes.
Common mistakes
- Confusing "cookieless" with "no consent needed". A tool can avoid cookies and still read the device or process personal data.
- Assuming Matomo is exempt by default. The standard configuration is not; the exemption requires a specific, documented setup.
- Forgetting to inform users. The exemption does not remove the duty to inform and to offer an opt-out.
- Believing GA4 is exempt. It is not: it needs a compliant CMP and Consent Mode v2 to be used lawfully in the EU.
- Stacking tools without an audit. Running a cookieless tool alongside GA4 creates duplicate data and legal basis questions. Record each processing activity in your register.
How to build a cookieless measurement strategy
- Start with an audit. Run a cookie scanner to see every cookie and tracker on your site and which ones depend on third-party cookies. Our website cookie audit guide details the method.
- Define your needs. Simple audience measurement, or conversion tracking and advertising attribution?
- Set up a compliant CMP that really blocks scripts before consent, with consent management that covers every service.
- Choose your measurement layer: an exempt or cookieless tool for audience, Consent Mode v2 for Google services, server-side tracking for conversion APIs.
- Build your first-party data foundation.
- Test and monitor: check in private browsing that nothing consent-required runs without agreement, then verify it again after every change. FlowConsent's compliance verification scans your pages while refusing consent.
Cookieless analytics checklist
- Audit every cookie and tracker on your site.
- Identify trackers that depend on third-party cookies.
- Define your need: audience measurement only, or conversions and advertising.
- For audience: evaluate Matomo in exempt mode or a cookieless tool.
- Check every exemption condition: purpose, no cross-referencing, no transfer, anonymised IP, 13 and 25 month limits.
- Set up a CMP that blocks scripts before consent.
- Enable Consent Mode v2 for Google services.
- Configure server-side tracking for conversion APIs, with consent.
- Record each analytics processing activity in your register.
- Inform visitors in the privacy policy, with an opt-out link.
- Test end-to-end conversion tracking and train marketing teams on the new metrics.
- Re-scan after every analytics tool update, and consult your DPO if you combine several tools.
Conclusion
Cookieless measurement is an operational reality, not a future problem: Safari, Firefox, ad blockers and consent refusals already put a large share of your visitors out of reach of classic tracking. The exemption is the most direct route to measure audience without a banner, under strict conditions; for conversions and advertising, Consent Mode v2 and server-side tracking with consent remain essential. Start by scanning your site to see which analytics cookies are active today.