How cookie-free tracking actually works (and what it can't do)
No cookie means no persistent visitor ID. Here's what Embaze uses instead, and the real tradeoffs that come with it.
Most analytics tools identify a visitor with a cookie: a random ID written to the browser on the first visit, then read back on every visit after. That ID is what lets a tool say "this is a returning visitor" weeks later — and it's also exactly what triggers cookie-consent law in the EU and UK, because it's a persistent identifier tied to one person's device.
Embaze doesn't set that cookie. Here's the actual mechanism, not the marketing version of it.
What identifies a visitor instead
Each pageview is hashed with SHA-256 from a server-side salt, the visitor's IP address, their user agent string, and the current date — nothing is written to the browser at all. Because the date is part of the hash, a given real person gets a different visitor hash every calendar day. That's deliberate: it means Embaze never stores anything that can identify the same person across days, which is a big part of why it doesn't need a cookie banner.
Sessions work differently — they use a random ID Embaze writes to sessionStorage (not a cookie) the first time the script runs on a tab. sessionStorage is cleared the moment that tab closes, so a session never survives a closed tab or a new browser session, by design.
The real tradeoff
Because the visitor hash rotates daily, "unique visitors" over a multi-day range is an approximation, not an exact headcount: someone who visits on both Monday and Wednesday contributes two different hashes to that range, so they're counted as two unique visitors even though they're one person. Day-level dedup is exact; multi-day dedup trends slightly high. This is the same tradeoff every cookie-free analytics tool makes — Plausible and Fathom both do something similar — and it's the direct cost of not tracking anyone across days.
- No cross-session identity, ever — Embaze can't tell you a specific visitor came back next month
- No cross-device stitching — the same person on phone and laptop is two separate visitors
- "Unique visitors" over long ranges trends slightly high, for the reason above
If you need exact long-term visitor identity — a logged-in product analytics use case, not a marketing-site traffic use case — a cookie-free tool like Embaze is the wrong layer. For "how much traffic am I getting and where's it coming from," the tradeoff is usually the right one.