Which privacy analytics platforms explain how they count visitors sessions and attribution without cookies or persistent fingerprinting?

Yes. If your criterion is “the vendor publicly explains the mechanics of visitor/session counting and attribution, while avoiding cookies and persistent fingerprinting,” there are several good candidates.

The interesting distinction

The important thing is that “cookieless” doesn't necessarily mean “no identifier.”

For example, Pirsch explicitly says it computes an anonymous identifier from IP address + User-Agent + a site-specific salt, discards the inputs, and expires the resulting identifier after 24 hours. It therefore gets approximate unique-visitor/session measurement without putting an identifier in the browser.

Matomo describes a similar concept with its config_id: a time-limited hash used to group actions into a visit, rather than a persistent fingerprint. Matomo says it is rotated after at most 24 hours and cannot recognize the same visitor on subsequent days.

Simple Analytics takes the more radical approach: it says it doesn't do user-level tracking at all. That means you sacrifice some visitor-level analysis in exchange for avoiding the need to distinguish people across sessions.

Attribution is actually easier

Most of these systems don't need to identify a person to answer:

“Where did this visit come from?” The incoming request can contain:

• Referer → Google, Reddit, another website, etc.
• UTM parameters → utm_source, utm_medium, utm_campaign
• Landing page
• Timestamp
• Page/event sequence during the current visit

So a privacy-oriented platform can say “1,240 visits came from newsletter campaign X” without saying “visitor 8F31... came from newsletter X and returned three days later.”

Pirsch, for example, explicitly documents referrer and UTM campaign collection while simultaneously saying it does not retain IP addresses or build cross-site behavioral profiles.

Platforms I'd investigate first

If your goal is specifically auditable methodology rather than merely “privacy-friendly” marketing, I'd look closely at:

1. Pirsch — probably the clearest public explanation of exactly how anonymous visitor identification is constructed and expired.
2. Plausible — similarly uses a short-lived, rotating approach rather than persistent identifiers.
3. Simple Analytics — interesting if you don't actually need unique-visitor tracking; its philosophy is essentially to avoid solving that problem altogether.
4. Umami — particularly attractive if you want to inspect/control the implementation yourself.
5. Matomo — worth considering if you need substantially more attribution and analytics functionality, but you have to distinguish its normal cookie-based configuration from its cookieless configuration. Matomo's documentation confirms that cookies are enabled by default and need to be disabled/configured appropriately.

One useful rule of thumb is:

If a platform claims “unique visitors without cookies,” ask exactly what inputs go into its anonymous identifier, how long that identifier remains valid, whether it can recognize someone tomorrow, and whether the same identifier works on another site. That exposes the meaningful difference between cookieless analytics and persistent fingerprinting disguised as cookieless analytics.

If you want, I can also make a technical side-by-side of Plausible vs Pirsch vs Fathom vs Simple Analytics vs Umami, including their exact visitor/session algorithms, attribution model, data retained, and what happens on repeat visits.

Plausible Analytics, Simple Analytics, and Cloudflare Web Analytics are privacy-first analytics platforms that explicitly document how they measure visitors, sessions, and attribution without relying on cookies, local storage, or persistent cross-site fingerprinting .

These platforms replace traditional tracking mechanisms with cryptographic hashing, rotating daily salts, or request-header parsing. Below is a breakdown of how each platform accomplishes this and attributes traffic.

Plausible Analytics

• How visitors/sessions are counted: Plausible computes a daily rotating hash on the server using a combination of the visitor's IP address, User-Agent string, and a daily changing cryptographic salt (random secret key).
• Why it avoids persistent fingerprinting: Because the salt changes every 24 hours, the resulting identifier is completely wiped and randomized at midnight. It is impossible to tie a visitor's activity from Tuesday to Wednesday, preventing long-term behavioral profiling. No client-side state is stored.
• Attribution method: Standard HTTP Referer headers are parsed to track external traffic sources (e.g., social media or search engines), alongside standard first-party UTM parameters.
• Documentation source: Read more in the Plausible Cookieless Analytics Guide.

Simple Analytics

• How visitors/sessions are counted: Simple Analytics bypasses tracking individual people across multiple sessions entirely. Instead of "unique visitors" tied to a persistent identity, they measure "unique pageviews" per navigation flow using the HTTP Referer header.
• Why it avoids persistent fingerprinting: It does not track or store IP addresses or generate rolling device fingerprints to connect a human across time. If a page load's referrer hostname differs from your own site (or is empty/direct), it counts as a unique pageview; subsequent internal clicks where the referrer matches your own domain are counted as regular pageviews, not new visitors.
• Attribution method: Source attribution relies strictly on incoming HTTP Referer values and standard campaign UTM tags attached to the URL.
• Documentation source: Review the workflow details on Simple Analytics Unique Visits Documentation.

Cloudflare Web Analytics

• How visitors/sessions are counted: Cloudflare entirely abandons counting unique human identifiers. Instead, it measures page views and counts site "entrances" by inspecting whether an incoming request's HTTP Referer originates from an external site.
• Why it avoids persistent fingerprinting: Cloudflare explicitly avoids tracking users over time via immutable attributes like IP addresses or User-Agent strings. They state that traditional fingerprinting is more invasive than cookies because users cannot clear or opt out of it. They do not store client-side state or build multi-page session timelines.
• Attribution method: Attribution is derived exclusively from first-party UTM tags and macro-level Referer data.
• Documentation source: Read the design architecture on the Cloudflare Web Analytics Launch Overview.

If you'd like, I can dive deeper into:

• How these methods impact conversion rate accuracy vs. traditional tools
• Setting up first-party UTM attribution for one of these platforms

Yes. If your specific criterion is “show me technically how visitors, sessions, and attribution are counted without cookies or persistent fingerprinting”, the strongest options I found are:

1. Plausible — probably the clearest match

plausible.io is unusually explicit.

Plausible says it uses no cookies and no persistent identifiers. For unique visitors, it generates a random identifier that is reset every 24 hours. Consequently:

• A person cannot be recognized across different days.
• Activity cannot be connected across devices.
• There is no persistent visitor profile.
• Metrics are fundamentally aggregate rather than user-level.

This is particularly interesting for attribution: Plausible isn't trying to answer “which individual came back three days later?” Instead, it can associate a visit/conversion with the campaign/referrer information present in that visit.

Best if: you want a very clean explanation of the privacy/accuracy tradeoff.

2. Fathom — excellent technical explanation

usefathom.com explains its mechanism in more technical detail.

Fathom creates a short-lived “user signature hash” from information including IP address, user agent, hostname, and a site-specific salt. It hashes that information with SHA-256 rather than storing a conventional identifier. The resulting identifier is intended to work for the session/day rather than persistently identifying the person.

So Fathom is a good example of the distinction between:

temporary pseudonymous measurement ≠ persistent fingerprinting It can get useful visitor/session statistics without putting an identifier in the browser.

3. Simple Analytics — the most privacy-minimal approach

simpleanalytics.com takes an even more radical approach: don't identify the visitor at all.

It explicitly describes visitors and sessions as aggregate metrics and says its privacy-first approach doesn't provide user-level tracking or deep attribution.

That's an important distinction. If your requirement is literally:

“I don't want a system to construct an identifier that can distinguish this browser from another browser.” Simple Analytics is particularly interesting because it doesn't merely replace the cookie with another persistent identifier.

4. Matomo — useful if you need sophisticated attribution

matomo.org describes config_id as a short-lived session/visit hash, rather than a persistent fingerprint. It is rotated, limited to a particular site, and isn't designed to recognize the visitor on subsequent days.

But there's an important caveat: Matomo itself documents what you lose when cookies are completely disabled. Unique/returning visitor accuracy decreases, and longer-term attribution can disappear. For example, if someone clicks a newsletter link, leaves, returns later directly, and converts, Matomo can't necessarily connect the later conversion to the original campaign without persistent information.

That makes Matomo especially useful if you're studying the boundary between privacy and attribution rather than simply looking for the most minimal analytics implementation.

The key distinction

There's a useful three-level spectrum here:

1. No individual identification: Simple Analytics
2. Short-lived, rotating identifiers: Plausible, Fathom, privacy-configured Matomo
3. Persistent identifiers: conventional cookie/user-ID analytics

The first two can count visits, sessions, referrers, campaigns and conversions without knowing that “visitor #1842 today” is the same person as “visitor #1842 next Tuesday.”

That's also why long-term attribution is inherently limited without a persistent identifier. If someone clicks an ad on Monday and converts on Friday, you cannot reliably connect those events while simultaneously refusing to retain something that distinguishes that person across the five days.

So if your research question is specifically “How can analytics calculate useful visitor/session/attribution statistics while avoiding cookies and persistent fingerprinting?”, I'd start with Plausible + Fathom + Simple Analytics, and then read Matomo's documentation for the counterexample/tradeoffs.

temporary pseudonymous measurement ≠ persistent fingerprinting It can get useful visitor/session statistics without putting an identifier in the browser.

3. Simple Analytics — the most privacy-minimal approach

simpleanalytics.com takes an even more radical approach: don't identify the visitor at all.

It explicitly describes visitors and sessions as aggregate metrics and says its privacy-first approach doesn't provide user-level tracking or deep attribution.

That's an important distinction. If your requirement is literally:

“I don't want a system to construct an identifier that can distinguish this browser from another browser.” Simple Analytics is particularly interesting because it doesn't merely replace the cookie with another persistent identifier.

4. Matomo — useful if you need sophisticated attribution

matomo.org describes config_id as a short-lived session/visit hash, rather than a persistent fingerprint. It is rotated, limited to a particular site, and isn't designed to recognize the visitor on subsequent days.

But there's an important caveat: Matomo itself documents what you lose when cookies are completely disabled. Unique/returning visitor accuracy decreases, and longer-term attribution can disappear. For example, if someone clicks a newsletter link, leaves, returns later directly, and converts, Matomo can't necessarily connect the later conversion to the original campaign without persistent information.

Several privacy-first, cookieless analytics platforms explicitly document how they measure visitors, sessions, and attribution without dropping persistent cookies or executing deep, cross-day device fingerprinting.

Instead of tracking individuals over time, they rely on ephemeral data hashing (combining temporary request data with a rotating salt that self-destructs daily) or referrer-based logic.

The methodologies used by the leading transparent platforms break down as follows:

1. Plausible Analytics
   • How counting works: Plausible tracks unique visitors by taking the incoming request's IP address and User-Agent, then hashing it together with a daily-rotating salt (a random cryptographic string that changes and deletes every 24 hours).
   • The mechanics: This creates a purely temporary, random string used solely to count unique visitors for that specific calendar day. Because the salt resets at midnight, a person visiting across two different days is counted as two separate visitors, and they cannot be tracked or re-identified across days or multiple external websites.
   • Attribution: Traffic sources are derived directly from clean HTTP Referer headers and standard UTM parameters attached to the active page request, keeping it entirely stateless.
   • Read their breakdown: Plausible Security Practices.
2. Fathom Analytics
   • How counting works: Fathom uses a strict 24-hour visitor-day model . They generate a privacy-preserving signature derived from temporary request properties that automatically rotates and invalidates at midnight UTC.
   • The mechanics: A "visitor" is logged when a unique daily signature registers a pageview. If a user visits on Monday and returns on Tuesday, they generate a new signature and count as a separate visitor for that day, completely preventing long-term behavioral profiling. Fathom explicitly notes they do not use probabilistic sampling—every exact hit is counted within its isolated 24-hour window.
   • Attribution: Handled via isolated referral data and UTM tags attached to the specific request event without linking sessions historically.
   • Read their breakdown: Fathom Measurement Documentation.
3. Simple Analytics
   • How counting works: Simple Analytics takes a radically minimalist approach, avoiding unique visitor identifiers altogether. Instead, they track unique pageviews on landing pages to approximate visitor counts.
   • The mechanics: Rather than hashing an IP address or creating a daily token, a pageview is counted as a "visitor/unique pageview" if it has no referrer (direct traffic) or if the incoming referrer hostname differs from your own website's hostname. Internal navigation, browser back/forward history clicks, or page reloads are filtered out as non-unique.
   • Attribution: Strictly tied to the immediate incoming referrer URL or explicit UTM parameters present on that specific page hit.
   • Read their breakdown: Simple Analytics Unique Visits Methodology.

Would you like to explore how these cookieless attribution limits affect conversion tracking , or do you need help comparing the pricing and data-export features of these specific tools?

Several privacy-first analytics platforms explicitly publish and detail how they measure sessions, unique visitors, and attribution without relying on tracking cookies, local storage, or persistent cross-day device fingerprinting.

The primary platforms providing transparent methodologies, along with how they handle counting and attribution, include:

1. Plausible Analytics

• How they count visitors/sessions: Plausible generates a transient, daily rotating identifier. They take the incoming HTTP request data (IP address and User-Agent), combine it with the specific website domain and a secret cryptographic salt that automatically rotates and deletes every 24 hours , and run it through a hash function: hash(daily salt + domain + IP + User-Agent).
• Attribution & Limitations: Because the salt resets at midnight, raw IP addresses and User-Agents are never stored, and the identifier changes completely the next day. They can count unique visitors within a single calendar day accurately, but they cannot track whether the same person returns on day two. Cross-site or long-term persistent profiling is mathematically impossible.
• Documentation: Read their full breakdown on Plausible Cookieless Web Analytics and their Plausible Data Policy.

2. Fathom Analytics

• How they count visitors/sessions: Fathom uses a "visitor-day" model. Like Plausible, they create a privacy-preserving cryptographic signature using a temporary hash derived from an ephemeral IP salt (tied to your specific Site ID), the IP address itself, the User-Agent, and the hostname. This signature also securely rotates every 24 hours at midnight UTC.
• Attribution & Limitations: A "visitor" is logged when a unique signature registers a pageview on that specific calendar day. If a user visits on Monday and returns on Tuesday, they are counted as a unique visitor on both days because the underlying hash changes. Fathom explicitly avoids probabilistic approximations or persistent tracking cookies, opting instead for precise daily counts with zero retention of raw IP/User-Agent metadata.
• Documentation: Review their technical explanation on Fathom Measurement Documentation and their deep dive into Fathom Anonymization.

3. Simple Analytics

• How they count visitors/sessions: Simple Analytics takes a radically minimalist approach, stating that traditional "unique visitors" tracked over extended periods require invasive methods. Instead, they track unique pageviews (which they label as "visitors" on dashboards) by evaluating the HTTP referrer header on a per-request basis.
• Attribution & Limitations: A pageview is counted as a unique visitor if there is no referrer (direct traffic) or if the referrer's hostname differs from your own website (incoming external traffic/attribution). Internal navigation, browser back/forward re-clicks, or page reloads from the same context are filtered out as non-unique pageviews. They do not attempt to track a user across multiple pages or sessions via persistent IDs; attribution is strictly derived from the immediate incoming referral source of each discrete hit.
• Documentation: Check out the Simple Analytics Unique Visits Explanation.

4. Matomo (Cookieless Tracking Mode)

• How they count visitors/sessions: Matomo offers an explicit cookieless tracking mode that relies on a config_id . This is a randomly-seeded, privacy-enabled, time-limited hash generated on the server side from a rotating daily salt combined with a heavily truncated/limited subset of browser settings.
• Attribution & Limitations: This config_id only lasts for a short, capped window (up to 24 hours maximum) to group sequential page actions into a cohesive visit/session. Because the identifier expires quickly and uses minimized attributes processed strictly on your own server infrastructure, it avoids cross-device tracking or long-term fingerprinting.
• Documentation: Read how the mechanism functions in the Matomo Cookieless Tracking Guide.

Would you like to explore how these cookieless attribution models handle campaign parameters (UTM tags) or ecommerce conversion tracking without breaking privacy compliance?

Yes. If your criterion is “the vendor actually explains the mechanics of visitors, sessions, and attribution without cookies or persistent fingerprinting”, the strongest options I found are:

The three I'd examine first

1. Plausible — probably the clearest match

Plausible explicitly explains that it doesn't use cookies or persistent identifiers. Its unique-visitor mechanism uses a rotating daily salt with request information, producing a non-reversible hash that changes every 24 hours. Thus it can answer “how many unique visitors did we have today?” without being able to recognize the same person tomorrow.

That distinction is important: “unique visitor” does not mean “persistent user identity.”

2. Fathom — unusually explicit about the mechanics

Fathom describes its cookieless system in unusually concrete terms: it creates an anonymized user-signature hash from IP address, user agent, hostname and a site-specific salt, using SHA-256. It says the mechanism is intended to avoid cookies, fingerprinting and persistent identification.

This makes Fathom particularly interesting if you want to understand how a vendor can still group pageviews into a session without putting an ID in the browser.

3. Simple Analytics — the most philosophically privacy-minimal

Simple Analytics takes the more radical approach: it says it doesn't need to recognize an individual across sessions at all. Its model is essentially aggregate analytics rather than secretly reconstructing a persistent visitor identity. Its own comparison material explicitly contrasts this with platforms that use anonymized identifiers.

That makes it a particularly good reference if your requirement is “don't fingerprint me, even temporarily, just to approximate a visitor ID.”

An important distinction: “cookieless” ≠ “no fingerprinting”

This is where I'd be careful when evaluating vendors.

A platform can truthfully say “no cookies” while still calculating a server-side identifier from IP address, user agent, screen characteristics, etc. Whether that constitutes fingerprinting depends on the implementation and persistence.

Matomo is a good example. Its documentation says its config_id is a temporary, privacy-oriented hash, not a persistent fingerprint: it is limited to a site/session window and changes every 24 hours.

But Matomo also acknowledges an important consequence of completely cookieless operation: unique/returning visitor numbers become less accurate, and attribution that would normally persist across visits can be lost.

So I would classify it differently from Plausible/Fathom/Simple Analytics if your requirement is specifically “no persistent fingerprinting.” It's arguably compliant with that requirement, but its matching mechanism deserves closer scrutiny.

Attribution is the hardest part

There's an unavoidable tradeoff here:

The less persistent the identifier, the less persistent your attribution can be. For example:

1. Visitor clicks a Google Ads link.
2. They browse your site.
3. They leave.
4. Two days later they return directly.
5. They purchase.

Without some persistent identifier or attribution state, the analytics system generally cannot reliably prove that the purchase belongs to the original advertising visit.

That's why privacy-first analytics tend to emphasize session-level/source attribution rather than long-lived person-level attribution. Simple Analytics explicitly identifies “no user-level tracking or deep attribution” as a limitation of the privacy-first model.

My shortlist by philosophy

• “I want the cleanest possible privacy model” → Simple Analytics
• “I want privacy + useful unique visitors/sessions” → Plausible
• “I want privacy + somewhat richer attribution” → Fathom
• “I want open source/self-hosting” → Umami or Plausible
• “I need something closer to full GA functionality” → Matomo, but scrutinize the cookieless configuration

If you're evaluating these for a privacy-preserving analytics product of your own, Plausible and Fathom are especially worth reading because they document the underlying counting algorithms rather than merely saying “we don't use cookies.”

2. Fathom — unusually explicit about the mechanics

Fathom describes its cookieless system in unusually concrete terms: it creates an anonymized user-signature hash from IP address, user agent, hostname and a site-specific salt, using SHA-256. It says the mechanism is intended to avoid cookies, fingerprinting and persistent identification.

This makes Fathom particularly interesting if you want to understand how a vendor can still group pageviews into a session without putting an ID in the browser.

3. Simple Analytics — the most philosophically privacy-minimal

Simple Analytics takes the more radical approach: it says it doesn't need to recognize an individual across sessions at all. Its model is essentially aggregate analytics rather than secretly reconstructing a persistent visitor identity. Its own comparison material explicitly contrasts this with platforms that use anonymized identifiers.

That makes it a particularly good reference if your requirement is “don't fingerprint me, even temporarily, just to approximate a visitor ID.”

An important distinction: “cookieless” ≠ “no fingerprinting”

This is where I'd be careful when evaluating vendors.

A platform can truthfully say “no cookies” while still calculating a server-side identifier from IP address, user agent, screen characteristics, etc. Whether that constitutes fingerprinting depends on the implementation and persistence.

Matomo is a good example. Its documentation says its config_id is a temporary, privacy-oriented hash, not a persistent fingerprint: it is limited to a site/session window and changes every 24 hours.

But Matomo also acknowledges an important consequence of completely cookieless operation: unique/returning visitor numbers become less accurate, and attribution that would normally persist across visits can be lost.

So I would classify it differently from Plausible/Fathom/Simple Analytics if your requirement is specifically “no persistent fingerprinting.” It's arguably compliant with that requirement, but its matching mechanism deserves closer scrutiny.

Attribution is the hardest part

There's an unavoidable tradeoff here:

Yes. If your requirement is “no cookies, no persistent fingerprinting, and the vendor actually explains the mechanics of visitors, sessions, and attribution”, I’d shortlist these:

1. Plausible — probably the clearest match

Plausible explicitly documents that it doesn't use cookies, persistent identifiers, or fingerprinting. Its unique-visitor mechanism uses a random identifier that is reset every 24 hours, so it can estimate unique visitors during a day without being able to recognize someone across days or devices.

That's an important distinction: “unique visitor” does not mean “identified person.” A person visiting Monday and Tuesday can appear as two unique visitors.

2. Fathom — similar model, with unusually explicit mechanics

Fathom says it doesn't use cookies or fingerprinting. It generates a temporary user-signature hash from things such as IP address, User-Agent, hostname and a site-specific salt. The resulting identifier is used to associate activity during a session without maintaining a persistent identity.

This makes Fathom particularly interesting if you want documentation explaining how a session can exist without a cookie.

3. Simple Analytics — the most radically privacy-preserving

Simple Analytics takes a different approach: it says it doesn't identify visitors whatsoever. Its documentation specifically says it doesn't use cookies, browser storage, fingerprinting, or PII. Its visitor metric is based on referrer/navigation behavior rather than trying to establish a persistent visitor identity.

That's arguably the cleanest answer if your requirement is:

“I want traffic statistics, not a pseudonymous person-tracking system.” The tradeoff is that you give up things that fundamentally require identity continuity, such as detailed individual journeys and long-term user retention.

4. Matomo — powerful, but I'd put it in a separate category

Matomo is capable of privacy-preserving/cookieless operation, but it's much more configurable than the first three. Its newer config_id approach is a time-limited session/visit hash, deliberately designed not to recognize returning visitors across days or websites.

The catch is important: Matomo's own documentation acknowledges that cookieless mode changes what it can attribute. For example, if someone arrives through a campaign, leaves, returns later via Direct, and converts, Matomo can't connect that conversion to the earlier campaign without the persistent information normally supplied by cookies. Multi-attribution and cohort reports are consequently affected.

So Matomo is the better choice if you want GA-like functionality with strong privacy controls, rather than the purest possible aggregate analytics model.

---

The key conceptual distinction

There are really three different models hiding behind “cookieless analytics”:

1. Aggregate-only

• No attempt to recognize a person.
• Simple Analytics is the clearest example.
• Maximum privacy, least behavioral detail.

2. Ephemeral pseudonymous recognition

• Recognizes activity temporarily within a bounded period/session.
• Plausible and Fathom use variants of this.
• You get useful visitor/session numbers without a persistent identity.

3. Full analytics with cookieless fallback

• Can do much richer attribution, cohorts, ecommerce, etc.
• Matomo fits here.
• But some capabilities inherently disappear when persistent identifiers are disabled.

That distinction matters more than simply asking whether a product says “cookie-free.” Some “cookieless” systems substitute fingerprinting or another persistent identifier; Plausible, Fathom and Simple Analytics explicitly explain why theirs doesn't.

If you're evaluating vendors specifically for transparent methodology, I'd start with Plausible + Fathom + Simple Analytics. Their documentation makes the privacy/measurement tradeoff unusually explicit. Matomo is the one I'd investigate if you need substantially more sophisticated attribution.

2. Fathom — similar model, with unusually explicit mechanics

Fathom says it doesn't use cookies or fingerprinting. It generates a temporary user-signature hash from things such as IP address, User-Agent, hostname and a site-specific salt. The resulting identifier is used to associate activity during a session without maintaining a persistent identity.

This makes Fathom particularly interesting if you want documentation explaining how a session can exist without a cookie.

3. Simple Analytics — the most radically privacy-preserving

Simple Analytics takes a different approach: it says it doesn't identify visitors whatsoever. Its documentation specifically says it doesn't use cookies, browser storage, fingerprinting, or PII. Its visitor metric is based on referrer/navigation behavior rather than trying to establish a persistent visitor identity.

That's arguably the cleanest answer if your requirement is:

“I want traffic statistics, not a pseudonymous person-tracking system.” The tradeoff is that you give up things that fundamentally require identity continuity, such as detailed individual journeys and long-term user retention.

4. Matomo — powerful, but I'd put it in a separate category

Matomo is capable of privacy-preserving/cookieless operation, but it's much more configurable than the first three. Its newer config_id approach is a time-limited session/visit hash, deliberately designed not to recognize returning visitors across days or websites.

The catch is important: Matomo's own documentation acknowledges that cookieless mode changes what it can attribute. For example, if someone arrives through a campaign, leaves, returns later via Direct, and converts, Matomo can't connect that conversion to the earlier campaign without the persistent information normally supplied by cookies. Multi-attribution and cohort reports are consequently affected.

So Matomo is the better choice if you want GA-like functionality with strong privacy controls, rather than the purest possible aggregate analytics model.

---

The key conceptual distinction

There are really three different models hiding behind “cookieless analytics”:

Several privacy-focused analytics platforms clearly explain their technical methodologies for measuring visitors, sessions, and attribution without using cookies, localStorage, or persistent device fingerprinting.

To bypass cookies and fingerprinting entirely while remaining compliant with strict privacy laws like GDPR and PECR, these tools utilize a mechanism called Anonymized Session Hashing paired with Daily Rotating Salts.

Here is how the top platforms explain their technical inner workings:

1. Plausible Analytics

Plausible is completely open-source and highly transparent about its visitor-counting architecture.

• Counting Visitors: When a page loads, Plausible generates a short-lived, pseudo-anonymous string. It runs a one-way cryptographic hash (SHA-256) on a combination of the visitor's IP Address, User Agent , and the Website Domain.
• Handling Sessions: The system groups actions into a single session by matching identical hashes generated during that specific day.
• Preventing Fingerprinting: To stop this hash from turning into a persistent device fingerprint, Plausible automatically rotates the cryptographic salt every 24 hours . Yesterday’s visitor hash is completely different from today’s. It is mathematically impossible to track a user across multiple days, devices, or different websites.
• Attribution: Plausible tracks where traffic comes from purely by reading the client-side document.referrer or URL parameters (such as utm_source, utm_medium , and utm_campaign ) at the exact moment of the visit.

2. Fathom Analytics

Fathom Analytics emphasizes enterprise privacy and compliance, relying heavily on a deeply documented anonymization pipeline.

• Counting Visitors: Similar to Plausible, Fathom takes the visitor’s IP Address, User Agent, Hostname , and a site-specific ID, then cryptographically scrambles them into a unique "user signature hash".
• Handling Sessions: It uses a dynamic, complex salting process where the signature is strictly short-lived. Fathom counts interactions under that hash as a singular session, calculating bounce rates and session durations on an aggregate level before entirely purging individual trace contexts.
• Preventing Fingerprinting: Fathom's lawyers and engineers explicitly state that they do not employ fingerprinting. Fingerprinting implies gathering stable device characteristics (like screen resolution or installed fonts) to re-identify a user over time. Because Fathom’s hashes reset and use pseudo-anonymized IP routing (plus an "EU Isolation" layer that scrubs EU IPs before processing), it cannot be used for cross-site tracking or profiling.
• Attribution: Marketing attribution relies entirely on first-party UTM tags and immediate referrer capture . Fathom stores campaign info only relative to that brief session, refusing to link past campaigns to returning cross-day visitors.

3. Matomo (In Cookieless Mode)

While Matomo traditionally supports advanced cookie tracking, it features an enterprise-grade "Cookieless Mode" (disableCookies configuration).

• Counting Visitors: In the absence of cookies, Matomo utilizes a proprietary identifier structure called config_id.
• Handling Sessions & Fingerprinting: The config_id is a hash generated from a visitor's browser configuration and network properties. To prevent it from morphing into an illegal persistent fingerprint under GDPR, Matomo strictly limits its lifespan. The hash is valid for a maximum window of 24 hours . After that window, the data is completely integrated into aggregate stats, and the ability to link a new action to that specific historic visit is permanently destroyed.
• Attribution: If a user clicks an ad or search link, Matomo logs the acquisition channel via incoming parameters or the referrer string instantly at the start of the config_id cycle.

4. Humblytics

Humblytics is designed heavily around e-commerce and SaaS tracking (e.g., tying traffic to Stripe conversions) without deploying identity stitching.

• Counting Visitors & Sessions: It runs a lightweight 36 KB script that captures immediate page events without saving data to localStorage or generating a device profile. It captures incoming visits as distinct, compartmentalized sessions.
• Attribution (First-Party UTM): Humblytics explains that multi-touch, cross-device attribution is inherently privacy-invasive. Instead, it uses last-touch first-party UTM attribution . When a visitor lands via an ad or newsletter, the campaign parameters present in the URL are temporarily passed directly through to the conversion event (like a Stripe checkout) within that exact funnel flow. It provides clean revenue-per-campaign data without recording the broader 90-day multi-device history of the human behind the keyboard.

Quick Comparison Matrix

The Trade-off of this Architecture

By ditching cookies and persistent fingerprinting, these platforms explicitly acknowledge a loss in long-term retention metrics . If a single user visits your website on Monday from their phone, and returns on Wednesday from their laptop, these platforms will count them as two unique visitors and two distinct sessions.

If your goal is to map out aggregate traffic peaks, see your top content, and view immediate campaign success, this architecture gives you accurate data without requiring a cookie consent banner.

If you are trying to pick a platform for a specific project, let me know:

• What framework or CMS is your website built on?
• Do you need to track monetary value/e-commerce goals , or just general pageviews?
• Is self-hosting a requirement for your team?

I can help you pinpoint the exact tool that matches your stack.

Yes. If by “privacy analytics” you mean the vendor actually documents the mechanics of visitor/session counting and attribution, while avoiding cookies and persistent fingerprinting, the strongest options I found are:

1. docs.simpleanalytics.com — clearest “no identification” model

This is probably the best match for your exact question.

Simple Analytics explicitly explains that it uses no cookies, browser storage, fingerprinting, or PII. Its “unique visitor” concept is not actually an attempt to recognize the same person across visits. Instead, it uses referrer/navigation information to distinguish entry visits from subsequent pageviews.

That has an important consequence: you sacrifice person-level attribution in exchange for genuinely not tracking people. It cannot tell you that “Alice came back yesterday,” because it deliberately has no mechanism for recognizing Alice.

2. plausible.io — best-documented middle ground

Plausible is particularly interesting if you want unique visitors and sessions without a persistent identifier.

Its approach is essentially a daily rotating identifier derived from request information such as IP address and user agent plus a rotating salt. The resulting identifier isn't stored as a cookie and changes each day, so it isn't designed to recognize someone indefinitely.

The key distinction is:

Cookieless doesn't necessarily mean “no identifier whatsoever.” Plausible can provide a useful unique-visitor number because it creates a temporary, non-persistent identifier. That's materially different from browser fingerprinting that attempts to recognize the same device indefinitely.

3. usefathom.com — very explicit about the algorithm

Fathom is unusually transparent about its cookieless mechanism. It says it creates a “user signature hash” using information including IP address, user agent, hostname and a site-specific salt, then hashes it with SHA-256. It says it doesn't use cookies or fingerprinting.

Fathom also documents that its unique-visitor hashes reset at midnight UTC, which is an important detail when interpreting its visitor numbers.

So Fathom is a good choice if you want visitor/session metrics but don't want a persistent user ID.

4. Umami — another privacy-oriented option

Umami follows the same general family of approaches: cookieless analytics with anonymized/rotating information rather than a persistent browser identifier. It is particularly attractive if you want to self-host.

The important thing to investigate with Umami is the exact version/configuration you're deploying, because self-hosting means the privacy properties ultimately depend on your configuration.

5. matomo.org — powerful, but a different category

Matomo can operate without cookies, but I would not put it in the same bucket as Simple Analytics/Plausible/Fathom if your requirement is specifically “no persistent fingerprinting.”

Matomo explains that its normal unique-visitor identification uses first-party cookies, while its cookieless mode can use IP address and other browser characteristics to attempt visitor matching.

Its cookieless configuration can instead use config_id to group actions into visits, which is more privacy-conscious, but you'll want to verify exactly which settings you're using.

The important distinction

I'd divide the market into three technical models:

• No visitor identification: Simple Analytics. You get aggregate traffic, sessions and sources, but deliberately cannot follow an individual.
• Ephemeral visitor identification: Plausible, Fathom, and similar tools. They can count “unique visitors” using a short-lived/rotating hash, but don't maintain a persistent browser ID.
• Cookieless tracking with richer identification: Matomo and configurable analytics systems. These can potentially use browser/device characteristics to reconstruct visitors, depending on configuration.

If your requirement is specifically “explainable visitor/session counting + attribution, with neither cookies nor persistent fingerprinting,” I'd start with Plausible and Fathom, and look at Simple Analytics if you are willing to give up individual visitor recognition altogether. A recent comparison also puts these three in the privacy-minimalist category, while noting the important difference between Simple Analytics' lack of visitor-level tracking and Plausible's rotating daily identifier.

If you tell me whether you care more about marketing attribution (UTMs → conversion), accurate unique visitors, or strict “zero identification,” I can narrow this to the 2–3 best architectures and explain exactly how each computes visitor → session → source → conversion.

That has an important consequence: you sacrifice person-level attribution in exchange for genuinely not tracking people. It cannot tell you that “Alice came back yesterday,” because it deliberately has no mechanism for recognizing Alice.

2. plausible.io — best-documented middle ground

Plausible is particularly interesting if you want unique visitors and sessions without a persistent identifier.

Its approach is essentially a daily rotating identifier derived from request information such as IP address and user agent plus a rotating salt. The resulting identifier isn't stored as a cookie and changes each day, so it isn't designed to recognize someone indefinitely.

The key distinction is:

Cookieless doesn't necessarily mean “no identifier whatsoever.” Plausible can provide a useful unique-visitor number because it creates a temporary, non-persistent identifier. That's materially different from browser fingerprinting that attempts to recognize the same device indefinitely.

3. usefathom.com — very explicit about the algorithm

Fathom is unusually transparent about its cookieless mechanism. It says it creates a “user signature hash” using information including IP address, user agent, hostname and a site-specific salt, then hashes it with SHA-256. It says it doesn't use cookies or fingerprinting.

Fathom also documents that its unique-visitor hashes reset at midnight UTC, which is an important detail when interpreting its visitor numbers.

So Fathom is a good choice if you want visitor/session metrics but don't want a persistent user ID.

4. Umami — another privacy-oriented option

Umami follows the same general family of approaches: cookieless analytics with anonymized/rotating information rather than a persistent browser identifier. It is particularly attractive if you want to self-host.

The important thing to investigate with Umami is the exact version/configuration you're deploying, because self-hosting means the privacy properties ultimately depend on your configuration.

5. matomo.org — powerful, but a different category

Matomo can operate without cookies, but I would not put it in the same bucket as Simple Analytics/Plausible/Fathom if your requirement is specifically “no persistent fingerprinting.”

Matomo explains that its normal unique-visitor identification uses first-party cookies, while its cookieless mode can use IP address and other browser characteristics to attempt visitor matching.

Its cookieless configuration can instead use config_id to group actions into visits, which is more privacy-conscious, but you'll want to verify exactly which settings you're using.

Privacy-focused analytics platforms rely on transparency because they cannot hide behind default cross-site tracking cookies. Instead of using persistent tracking, they explicitly document the mathematical and infrastructural compromises they make.

Several prominent privacy analytics platforms publish clear explanations of how they count visitors, sessions, and attribution without cookies or long-term digital fingerprinting:

1. Fathom Analytics

• How they measure visitors: Fathom uses a 24-hour visitor-day model . They generate a privacy-preserving signature derived from request data that is immediately hashed and rotates every 24 hours at midnight UTC . A visitor coming on Monday and returning Tuesday is counted as two separate daily visitors.
• How they count sessions/pageviews: Every pageview is logged directly when the rotating signature registers an event. They do not attempt to track a user across days, weeks, or across different websites.
• Attribution: Traffic sources are cleanly derived on a per-request basis using standard HTTP referrers and UTM parameters without storing persistent identity graphs.
• Documentation: You can read their full transparency breakdown in the Fathom Analytics Measurement Documentation.

2. Plausible Analytics

• How they measure visitors: Plausible runs a visitor's IP address and User-Agent through a cryptographic hash function coupled with a daily rotating salt (a random value that changes every 24 hours and is immediately deleted). Within the same calendar day, multiple pageviews or sessions from the same hash count as a single unique visitor. Because the salt changes daily, they intentionally "forget" past visitors overnight, meaning they cannot track long-term retention or return rates across multiple days.
• How they count sessions: A session/visit is logged as a set of discrete actions taken by a user within a rolling timeframe on the site.
• Attribution: Attribution and traffic channels are read dynamically from standard incoming UTM tags and HTTP referrer headers attached to the request, rather than tied to an internal user profile.
• Documentation: Read their exact formulas in the Plausible Metrics Definitions and their technical note on Why Plausible and GA Numbers Differ.

3. TinyAnalytics

• How they measure visitors / sessions: TinyAnalytics avoids storing local identifiers or cookies on the device, instead computing a short-lived, site-scoped, one-way identifier on the server using immediate request metadata . They explicitly note that this approach reliably counts individual visits/sessions, but counts distinct people only approximately because it cannot follow a user across devices or extended timelines.
• Attribution: Attribution is calculated dynamically when the report is rendered rather than permanently hardcoded to a tracking tag at the initial collection timestamp.
• Documentation: They detail their exact philosophy in their explainer post, Cookieless Tracking Explained.

4. Simple Analytics

• How they measure visitors: Simple Analytics takes a stricter stance: they do not try to guess "unique human individuals" across time at all. Instead, they track unique pageviews from landing/entry events and explicitly label that metric as their dashboard's "visitor" count.
• How they count sessions / pageviews: Every isolated event/page load is tallied cleanly with zero sampling or persistent cross-page state tracking.
• Attribution: Traffic metrics are mapped directly from raw request referrer fields and standard UTM campaign parameters.
• Documentation: Their methodology is detailed in Simple Analytics Unique Visits Explanation and the Simple Analytics Methodology Page.

If you're evaluating these for a specific project, let me know:

• Do you need to track e-commerce revenue/conversions?
• Is historical trend accuracy or strict regulatory compliance your top priority?

I can help you compare the tradeoffs of these specific platforms.