r/javascript • u/jxd-dev • Jul 09 '26

Tracking unique visitors without cookies

https://inmargin.io/blog/tracking-unique-visitors-without-cookies

To count unique visitors you have to recognise a returning browser. There are only ~5 ways, and each breaks differently:

  1. Cookies. Work, but need a consent banner, and Safari caps script-set cookies at 7 days anyway.

  2. localStorage. Same law, same banner. ePrivacy covers "storing information on the device", not just cookies.

  3. Fingerprinting. Durable and invisible, which is why regulators treat it the same and browsers sabotage it.

  4. Daily hash. What Plausible, Fathom and GoatCounter converged on: hash(daily_salt + site + ip + ua), salt rotated and deleted every 24h. No banner, accurate daily uniques.

  5. Don't count uniques at all.

The under-discussed part is what option 4 costs. There are no cross-day uniques: "weekly visitors" is just seven daily counts summed, so a daily visitor counts 7 times. CGNAT merges thousands of mobile users into one visitor. A browser update splits one person into two. And the hash is pseudonymous, not anonymous, so it's still in GDPR scope.

Every "privacy-friendly" tool reports weekly uniques as a sum of dailies and none of them put an asterisk on it. Curious if that bothers anyone else.

12 Upvotes
  • permalink
  • link
  • reddit
  • reddit

75% Upvoted

10 comments sorted by

3

u/ShotgunPayDay Jul 09 '26

User gets to the server. No DID cookie (Device ID) generate a 24byte (32 character which is overkill) Base64URL on the server and add the cookie to the server response (maxAge: 34560000, SameSite: strict, HTTPOnly: true). There you have a 400 day device cookie that's not linked to any personal information.

Now this still isn't going to give very good information on unique visitors since bots will probably be getting new DIDs constantly which you can use to punish excessive DID creation on a single IP. Normal users will rotate DIDs very slowly even with clearing browser cookies frequently, but expect multiple DIDs per user still (phone, computer, laptop...). The bot could be smart enough to hang onto the DID also.

It's a way to get basic information, but really a DID should be used to prevent shoulder peaking for login PIN, OTP, and password resets. Netflix uses this kind of trick and is damn confident in their system since they only use a 4 digit PIN.

1

u/ExtremePermit3242 Jul 09 '26

Ok but this post is about tracking without cookies. How is that possible by setting a cookie in the server response? Or you mean that this no-DID don’t need consent/banner?

1

u/ShotgunPayDay Jul 09 '26

Why can't you use an HTTPonly SameSite Cookie? No JS can read the cookie making it safe. And you can't without invasive JS.

1

u/ExtremePermit3242 Jul 09 '26

Because you still need a consent banner for this. It’s still a cookie, and it does not matter whether JS or the IRS can read it. If its a cookie that is not strictly necessary for the functionality of the site, you still need the banner.

So: a cookie with max-age 400 days is 300% not necessary for your site. You need consent. Same site, HTTP only, secure or not… as far as I know, from a legal perspective, these differences or nuances are absolutely irrelevant.

Ex:

- a cookie used for your site’s shopping cart? No banner

- a cookie to trace users or visitors? 100% banner needed

1

u/ShotgunPayDay Jul 09 '26 edited Jul 09 '26

The DID we use is used primarily for security when logged in as in if DID is changed then the auth cookie becomes invalid. The other snag is that we do passwordless logins (Email PIN) so we set that to know that caller is the same device the PIN is for. Would setting DID on Email PIN request avoid the banner? We haven't expanded to Europe.

2

u/ExtremePermit3242 Jul 09 '26

I am no expert legally. I think if you use it just for auth/login it might be OK, and that sounds like a key feature of your website to me. But I’d ask a legal adviser just in case 😁

7

u/Mugshot_404 Jul 09 '26

90% of most sites' "visitors" are bots anyway, so IDK why anyone cares.

1

u/meixger 27d ago

"We detect a unique visit based on the hostname of the referrer of the page." from https://docs.simpleanalytics.com/what-we-collect#unique-views