---
title: "Cookieless Web Analytics: A Privacy-First Guide | HitKeep"
description: "See what cookieless web analytics collects, when a banner may still matter, and how HitKeep handles sessions, IP data, hosting, retention, and exports."
canonical: "https://hitkeep.com/use-cases/privacy-first-web-analytics/"
---

A practical guide for site owners, developers, and privacy reviewers

# Privacy-friendly web analytics without cookies

HitKeep measures pageviews, sources, campaigns, events, goals, funnels, and ecommerce without analytics cookies in the public tracker. This guide explains what that does and does not mean, which data reaches HitKeep, and which decisions still belong to the site operator.

[Start free in HitKeep Cloud](https://cloud.hitkeep.eu/signup?utm_source=hitkeep_docs&utm_medium=privacy_en&utm_campaign=privacy_analytics_pillar&utm_content=privacy_en&plan=free&billing=monthly)[Read the self-hosting guide](https://hitkeep.com/guides/installation/)

![HitKeep analytics dashboard showing traffic, pages, referrers, audience, goals, and conversion context](https://hitkeep.com/_astro/analytics-ai-visibility-correlation.C1YgNC5M_Z1AtMo9.webp)

What “without cookies” meansData collected and avoidedCookie banner and consentHosting, retention, and exportsPrivacy notice templateFrequently asked questions

## The short answer

Cookieless analytics removes one common tracking mechanism. It does not automatically settle every privacy, consent, or ePrivacy question. HitKeep keeps the public tracker cookie-free by default, stores an opaque session tuple in sessionStorage, respects Do Not Track by default, and keeps deployment and retention choices visible.

Analytics cookiesThe public tracker does not set them.

Session continuityAn opaque tuple can be stored in sessionStorage.

Visitor IPNot stored as a raw analytics-hit field; it can be processed transiently to derive location and network metadata.

Data controlChoose EU or US Cloud, or run the same open-source foundation yourself.

![HitKeep analytics dashboard showing traffic, pages, referrers, audience, goals, and conversion context](https://hitkeep.com/_astro/dashboard-overview.C-D6Gj-G_1FmtsR.webp)

The same reporting surface is available in managed Cloud and the open-source self-hosted product.

## What cookieless web analytics means in practice

“Cookieless” describes storage behavior in the browser. A useful privacy review goes further and checks identifiers, request data, purposes, retention, recipients, and deployment.

| Technical fact | HitKeep behavior | What the operator still checks |
| --- | --- | --- |
| No analytics cookies | HitKeep’s public tracker does not create analytics cookies by default. | Verify the rest of your site separately. Login, commerce, embeds, chat, and advertising tools may still set cookies. |
| sessionStorage is separate | HitKeep can use sessionStorage for an opaque session tuple that expires with the browser session. | Depending on the jurisdiction and setup, access to browser storage can still be relevant under ePrivacy or PECR rules. |
| No advertising identity graph | HitKeep does not include retargeting audiences, cross-site advertising profiles, or ad-network synchronization. | Custom events can still contain sensitive data if you send it. Keep names and properties deliberate. |
| Do Not Track support | DNT is respected by default unless collection is explicitly configured otherwise. | Document any override and make sure it matches your public privacy explanation. |

## What HitKeep collects, derives, and leaves out

The accepted hit contains reporting context, not a raw copy of the browser request. These are the fields a site owner should understand before writing a privacy notice.

| Area | Recorded or derived | Privacy boundary |
| --- | --- | --- |
| Page and acquisition | Page path, referrer, landing and exit context, UTM campaign parameters | Useful for traffic sources and campaign reporting |
| Browser and device | Browser, device, operating system, and language context | Used for aggregate audience reports |
| Location and network | Derived country, region, city, provider, and ASN when IP metadata is available | The raw visitor IP is not stored as an analytics-hit field |
| Sessions | An opaque session tuple in sessionStorage | No analytics cookie is set by the public tracker |
| Automatic events | Outbound clicks, file downloads, and form submissions | Query strings, hashes, link text, form values, and request bodies are excluded from automatic-event content |
| Conversions | Custom events, goals, funnels, and ecommerce events you configure | You control event names and properties; do not send personal or secret values |

## Does cookieless analytics remove the need for a cookie banner?

Not as a universal rule. A banner is only one part of a wider legal and technical assessment. The answer depends on the storage used, the data and purpose, your jurisdiction, your legal basis, other tools on the page, and your exact HitKeep configuration.

What HitKeep can establishThe public tracker sets no analytics cookies by default and has no built-in advertising profile or cross-site retargeting layer.

What remains contextualsessionStorage, consent or objection mechanisms, legal basis, processor terms, retention, and transfers must match the deployment and local law.

Safe wordingSay exactly how your setup works. Avoid absolute claims such as “GDPR compliant” or “no consent required” unless your own qualified review supports them.

[Read the GDPR, PECR, and ePrivacy boundaries](https://hitkeep.com/compliance/pecr-eprivacy/)

## Choose who operates the analytics and how long data stays

Privacy is also an operating-model decision. HitKeep keeps the managed and self-hosted paths on the same product foundation and provides open-format takeout.

| Choice | What HitKeep provides | Your responsibility |
| --- | --- | --- |
| Managed EU Cloud | Managed operation in the EU region | Choose the EU region during signup and record the service in your privacy and processor documentation. |
| Managed US Cloud | Managed operation in the US region | Use when the US region fits your users and obligations; assess transfers when EU/UK data is involved. |
| Self-hosted | Run HitKeep on infrastructure you control | You control network, backups, retention, access, updates, and incident response. |
| Retention | Product retention and archive controls | Set periods that match the purpose you documented instead of keeping analytics indefinitely. |
| Takeout | Site data in JSON, CSV, Parquet, NDJSON, or XLSX | Export before a migration and test that the format fits your downstream use. |

## Privacy notice template for HitKeep

Use this as a technical starting point, not as legal advice. Replace every bracketed passage and remove anything that does not match your configuration.

**Web analytics with HitKeep**

### Web analytics with HitKeep

We use HitKeep to understand how our website is used. The analysis covers pageviews, traffic sources, campaigns, and the events or conversions that we configure. We do not use HitKeep to create advertising profiles, retarget visitors, or synchronize audiences with advertising networks.

Operation: [self-hosted on infrastructure we control / HitKeep Cloud in the EU region / HitKeep Cloud in the US region]. The public HitKeep tracker does not set analytics cookies. Depending on our configuration, an opaque session tuple may be stored in sessionStorage for session continuity.

The processed data can include page path, referrer, browser and device context, language, UTM parameters, and derived location and network metadata. Raw visitor IP addresses are not stored as an analytics-hit field, but may be processed transiently for location, security, trusted-proxy, exclusion, or spam-protection functions.

Our legal basis is [insert the basis confirmed for this deployment]. We retain analytics data for [period]. You can [object / withdraw consent / change privacy settings] by [method]. Further technical details are available in [link to this page or your own technical explanation].

## A six-step privacy review before you publish

The page is ready when the public wording and the deployed configuration say the same thing.

- Inventory every script, embed, login, commerce, and advertising tool on the page. A cookieless analytics tracker does not make the rest of the site cookieless.
- Confirm the HitKeep deployment region or self-hosted environment, processor relationship, access controls, and trusted-proxy setup.
- Review automatic and custom event names and properties. Do not send form values, secrets, email addresses, or other personal data.
- Set retention and archive behavior to a documented purpose and period.
- Decide how consent, objection, and Do Not Track should work in the jurisdictions you serve.
- Test the live site in browser developer tools, then keep the privacy notice updated when configuration changes.

## Verify the details

These pages are the current product references for the claims above.

[Tracker architecture](https://hitkeep.com/guides/tracking/tracker-architecture/)[Facts and limits](https://hitkeep.com/reference/facts-and-limits/)[GDPR guide](https://hitkeep.com/compliance/gdpr/)[PECR and ePrivacy guide](https://hitkeep.com/compliance/pecr-eprivacy/)[Retention and archiving](https://hitkeep.com/guides/data/retention/)[Data takeout](https://hitkeep.com/guides/data/takeout/)[Open-source repository](https://github.com/pascalebeier/hitkeep)

## Measure the site without handing it to an ad platform

Start in managed Cloud and choose the EU or US region before account creation, or install the open-source product on infrastructure you control.

[Start free in Cloud](https://cloud.hitkeep.eu/signup?utm_source=hitkeep_docs&utm_medium=privacy_en&utm_campaign=privacy_analytics_pillar&utm_content=privacy_en&plan=free&billing=monthly)[Self-host HitKeep](https://hitkeep.com/guides/installation/)

## Latest HitKeep updates for privacy-first analytics

Read the newest release first, then move through practical GA migration guidance for privacy-first and cookieless analytics.

Release v2.13.0

### HitKeep 2.13.0: Reports, Social Sign-In, and a Typed Tracker SDK

July 23, 2026

HitKeep 2.13.0 adds scheduled reporting, social sign-in, the typed @hitkeep/tracker SDK, prerender-safe collection, and isolated tenant analytics databases.

[Read release notes →](https://hitkeep.com/blog/hitkeep-2-13-0/)

From the blog

[!\[HitKeep Search Console dashboard showing clicks, impressions, click-through rate, position, queries, devices, and countries\](https://hitkeep.com/_astro/analytics-search-console.CSc92Uud_1y11Bk.webp)](https://hitkeep.com/blog/how-to-build-better-google-reporting-for-stakeholders/)

Published July 24, 2026·[Pascale Beier, HitKeep maintainer](https://github.com/pascalebeier)·5 min read

### How to Build Better Google Reporting for Stakeholders

Stakeholders rarely need more Google data; they need clearer decisions. This playbook turns search visibility, web traffic, conversion, and AI-era signals into recurring reporting that leads to action instead of chart fatigue.

Read post →

[!\[HitKeep dashboard showing pageviews, unique sessions, bounce rate, average duration, and a traffic comparison chart\](https://hitkeep.com/_astro/how-to-check-site-traffic-without-google-analytics-cover.BYhoRUgM_2hAwpH.webp)](https://hitkeep.com/blog/how-to-check-site-traffic-without-google-analytics/)

Published July 23, 2026·[Pascale Beier, HitKeep maintainer](https://github.com/pascalebeier)·12 min read

### How to Check Site Traffic Without Google Analytics

A practical 2026 guide to measuring visitors, sources, campaigns, search performance, conversions, and AI traffic without GA4.

Read post →

[!\[HitKeep dashboard showing visitors, pageviews, sessions, comparison deltas, and traffic trends\](https://hitkeep.com/_astro/google-analytics-vs-privacy-first-analytics-in-2026-cover.B8LN5wlN_1wNtv9.webp)](https://hitkeep.com/blog/google-analytics-vs-privacy-first-analytics-in-2026/)

Published July 22, 2026·[Pascale Beier, HitKeep maintainer](https://github.com/pascalebeier)·14 min read

### Google Analytics vs Privacy-First Analytics in 2026

A practical 2026 decision guide to GA4 and privacy-first analytics across consent, cookies, data control, AI traffic, and migration paths.

Read post →

##

Does HitKeep set analytics cookies?

No. The public HitKeep tracker does not set analytics cookies by default. It can use sessionStorage for an opaque session tuple, which is a separate browser-storage mechanism.

Can I use web analytics without a cookie banner?

Possibly, but “no cookies” is not enough to answer that for every site or jurisdiction. Review sessionStorage, the data and purpose, your legal basis, other page tools, consent or objection handling, and local ePrivacy or PECR rules.

Does HitKeep store visitor IP addresses?

Raw visitor IP addresses are not stored as an analytics-hit field. An address can be processed transiently for derived location and network metadata, trusted-proxy resolution, exclusions, security, or spam protection.

Is cookieless analytics automatically GDPR compliant?

No product can make that universal promise. HitKeep reduces the default tracking surface, but the controller still decides purpose, legal basis, retention, access, processor terms, transfers, and public information.

Can HitKeep be self-hosted?

Yes. HitKeep is open source and can run on your own infrastructure. Managed Cloud is also available in EU and US regions on the same product foundation.

Can I export all site analytics data?

HitKeep provides site takeout in JSON, CSV, Parquet, NDJSON, and XLSX. Review the takeout guide for the included analytics and control records.

Can I copy the privacy notice word for word?

No. It is a technical template. Replace the hosting model, legal basis, retention, processor, consent or objection path, and contact details so the text matches your deployment.