Website analytics without cookies, or a cookie banner

A website can measure visits, sources and conversions without ever setting a tracking cookie on a visitor’s device. Session-based storage that does not persist after the browser tab closes avoids the need for a cookie consent banner entirely. It does not just simplify one.

Why cookies trigger a consent banner and consent question in the first place

A cookie that persists across sessions is the specific mechanism most privacy frameworks worry about, especially one used to track a visitor across multiple visits or multiple sites. It lets a business build a profile of behaviour over time, often without the visitor even knowing. A banner exists to get informed consent before that kind of persistent tracking starts.

What cookie-free, cookieless analytics actually uses instead: Plausible, Fathom, Simple Analytics and Matomo, the privacy-friendly options

sessionStorage is a browser feature that holds data only for the current tab, and clears automatically when the tab closes. It can capture what is needed for basic attribution and conversion tracking — which channel a visitor arrived from, what they did during this one visit — without writing anything that survives after the visitor leaves. Because nothing is stored between visits, there is no cross-session tracking to get consent for. No cookie banner is needed for this specific mechanism.

A number of purpose-built analytics products are built around this cookieless, privacy-friendly model as their default, rather than as something a business has to configure itself. Plausible, Fathom and Simple Analytics are commonly cited examples. Matomo offers a cookieless mode alongside its more traditional, cookie-based setup. Each takes a slightly different technical approach to avoiding persistent identifiers. But all of them report aggregate pageviews, traffic sources and basic conversion counts without setting a tracking cookie by default.

What this approach cannot do, and why that trade-off is often acceptable

A cookieless, session-only approach cannot recognise a returning visitor as the same person across separate visits. It cannot build the kind of long-term behavioural profile a persistent tracking cookie enables. For most small businesses, the questions that actually matter do not need individual recognition across sessions. Which channel brought this visit? Did it lead to an enquiry? What is the trend over time in aggregate? None of that needs to identify individuals. That is why this trade-off is often a genuine improvement rather than a compromise: simpler compliance, a cleaner visitor experience with no banner interrupting the page, and still enough data to answer the real business questions.

Standard GA4 sets its own cookies by default, which is why this is a deliberate choice

Google Analytics 4, installed with its default configuration, sets its own first-party cookies to recognise a returning visitor and measure sessions across visits. The cookieless, session-only approach described on this page is not what a standard GA4 installation does out of the box. It is a deliberate architectural choice: configure measurement around sessionStorage instead, and skip GA4’s own default cross-session cookie behaviour, in exchange for the simpler compliance position covered here. A business that assumes its site is automatically cookieless because it uses GA4 is very likely wrong. Genuinely cookieless measurement needs to be specifically built or configured, not left at whichever tool’s own default.

sessionStorage and localStorage: cookie-based tracking, first-party attribution and cookieless tracking are not the same thing

Browsers offer more than one client-side storage mechanism, and the distinction matters directly to this page’s argument. sessionStorage clears automatically when a browser tab closes. That is exactly why it does not enable cross-session tracking, and does not trigger the same consent question a persistent cookie does. localStorage, by contrast, persists indefinitely until it is explicitly cleared. Using it in place of sessionStorage for the same purpose would quietly bring back a form of cross-session identification closer to what a cookie does. That undermines the actual privacy benefit of the cookieless approach, even though no cookie, technically, was ever set. The choice of storage mechanism, not merely the absence of the word “cookie”, is what does the actual work here.

Do Not Track and similar browser signals are a related but separate consideration

Some browsers offer a Do Not Track setting, or a similar privacy signal a visitor can turn on, expressing a general preference not to be tracked across sites. Support for these signals, and how consistently browsers interpret them, varies. It is not a settled, uniformly enforced standard, in the way the technical cookie mechanism described above is. A cookieless, session-only measurement approach already avoids the cross-site tracking these signals mainly worry about, which is a further point in its favour, independent of how consistently any particular browser signal is honoured.

The Australian legal picture, stated plainly

Australia does not have a direct cookie-consent law naming cookies specifically, unlike the ePrivacy framework in the European Union. The relevant Australian law is the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which govern the collection, use and disclosure of personal information generally. Whether a specific measurement approach requires disclosure or consent depends on whether it collects personal information as the Act defines it, not on whether a cookie specifically is involved. A cookieless, session-only, aggregate measurement approach that does not identify individuals is a stronger position to start from. It does not, though, automatically remove every privacy consideration. This is particularly true if any other part of the site separately collects personal information, which then falls under the Privacy Act on its own terms, regardless of the analytics approach.

None of this is legal advice specific to a given site’s full data practices; where doubt exists, get advice.

A short cookie banner comparison

	Cookie-based, persistent tracking	Session-based, cookieless tracking
Recognises a returning visitor across sessions	Yes	No
Requires a consent banner in most frameworks	Generally yes	Generally no, for the tracking mechanism itself
Sufficient for aggregate attribution and conversion tracking	Yes	Yes, for most small-business needs
Adds a visible interruption to the page (a banner)	Yes	No

What to do next

Check whether an existing analytics setup uses persistent cookies or session-based storage. Check whether a cookie banner currently shown is actually required given what is being collected. Some sites carry a banner as a default template inclusion, rather than a genuine requirement. For the technical build decisions this connects to, web development services covers where analytics architecture decisions like this sit in a project.