Counting website visitors without cookies: how it works

How many people visit my website, which pages do they read and where do they come from? Almost every business wants to know. At the same time, cookie banners are annoying. Here is an overview of how to count website visitors, what to consider legally in Germany and the EU and which solution suits a small business. This is not legal advice.

What you really need to know

For a local business a few figures are enough: visitors per day or week, the most read pages, where visitors come from (Google, direct, Instagram), whether they use a phone or computer and which page they enter on. More important than any statistic, though, is the number of enquiries.

The options compared

Google Analytics

Very comprehensive and free. But it sets cookies and transfers data to Google. In Germany that requires consent, meaning a cookie banner, and a section in the privacy policy. Anyone who declines is not counted, so the figures are often incomplete.

Matomo

You can run Matomo on your own server, so the data stays with you. It can be configured to work without cookies. Whether consent is still required then depends on the exact configuration.

Cookieless analytics services

There are services that work without cookies and count visitors only via identifiers that change daily. They are much more data-friendly than Google Analytics. However, because they run a script in the browser, it is disputed whether consent may still be required.

Server-side statistics

The server evaluates information that every browser sends with a page request anyway, similar to server log files. No script runs in the browser and nothing is stored on the device. This is the most data-friendly solution.

What the law says

§ 25 TDDDG, the German rule based on the EU ePrivacy Directive, requires consent when information is stored on the visitor's device or read from it, for example by a cookie. The European data protection authorities interpret "access" very broadly in their Guidelines 2/2023. Under that view, a script that makes the browser send data can also fall under it. Then there is the GDPR: if IP addresses are processed, a legal basis is needed, and data should be anonymised as early as possible. The less happens on the device and the less is stored, the lower the risk.

Can I see who visits my website?

No, and that is a good thing. Identifying individual visitors would only be possible with cookies or similar methods and with consent. Tools that try to identify companies behind visits by their IP address are problematic in terms of data protection.

How I do it

On this website the server counts visits itself. It stores no IP addresses and sets no cookies, which is why there is no cookie banner here. Several page views are combined into one visit via a checksum with a random value that changes daily. Anyone who has set "Do Not Track" is not counted. The details are in the privacy policy.

Frequently asked questions

Do I even need visitor statistics?

Not necessarily. But they help you see whether new pages or blog articles are read and where visitors come from. For the search terms on Google, the free Google Search Console is also useful.

Are free visitor counters a good idea?

Be careful with free counters from third parties: many are financed through data or advertising. Check where the data ends up and name the service in your privacy policy.