Cookie-Less Tracking Methods Websites Use Instead of Cookies

Blocking cookies stops a lot of tracking, but not all of it. Websites and ad companies have other ways to recognize you, and site owners have moved to analytics that don't use cookies at all. Here's what those methods are and what you can do about them.

How sites track you without cookies

• Browser fingerprinting. Your browser reveals many small details: screen size, fonts, graphics card behavior (through canvas and WebGL), time zone and language. Together they can be distinctive enough to recognize you across sites without storing anything.
• Other browser storage. Local storage, IndexedDB and cache tricks can hold an ID the way a cookie would. Clearing cookies alone doesn't remove them.
• Tracking IDs in links. Parameters like gclid and fbclid added to links carry an ID from an ad click to the site you land on.
• IP address. Combined with your browser details, it narrows down who you are, especially on a home connection.
• Logins. When you sign in or enter an email, a site can match you exactly, and some share hashed email addresses with ad partners.
• Server-side tracking. Instead of loading a tracker in your browser, the site's server sends event data straight to the ad platform. Meta's Conversions API and server-side tagging work this way, so browser blockers can't see it.

Cookieless analytics for site owners

Privacy-focused analytics tools such as Plausible, Fathom, Simple Analytics and Matomo (in its cookieless mode) count visits without setting cookies, usually by counting with a daily-changing anonymous hash instead of a persistent ID. Google Analytics 4 can send cookieless pings when visitors decline consent.

Does that mean no cookie banner? Not automatically. In the EU and UK, the rules cover storing or reading anything on a visitor's device, and personal data processing, not just cookies. Some cookieless tools are designed to need no consent, but whether yours does depends on how it's set up and where your visitors are. Check with whoever handles your privacy compliance.

How to reduce cookieless tracking

• Fingerprinting protection: Brave randomizes fingerprinting details by default, and Firefox blocks known fingerprinters. Chrome offers little protection here.
• A content blocker stops many trackers from loading in the first place, which also stops their fingerprinting scripts.
• Strip tracking parameters from links before you share or open them. Firefox and Brave remove some automatically.
• Sign in less. Use guest checkout and separate browser profiles for accounts you don't want linked.

Cookie banners still matter for the cookie part. Cookie Auto-Reject rejects non-essential cookies on banners automatically, though it can't stop the methods above. For more on fingerprinting, see why Incognito doesn't stop fingerprinting.