Cookieless tracking: measure website behavior with fewer cookie hurdles

For decades, cookies were the standard mechanism for recognising visitors. Exactly that recognition made them a subject of regulation: § 25 TDDDG (the German ePrivacy implementation) requires consent for storing and reading information on the device unless it is strictly necessary — and analytics cookies are not.

Add the technical erosion: browsers cap cookie lifetimes, third-party cookies are on the way out, and blockers filter known tracking cookies. A tool whose core depends on cookies loses substance — Microsoft documents this for Clarity itself: without cookie consent, per its own FAQ, Clarity cannot stitch a continuous user journey, recordings and funnels “might be impacted”, and one visitor turns into fragmented separate sessions (as of July 2026).

The root of the problem is not the cookie as a file, but the architectural decision to build recognition on a mechanism that has consent obligations, lifetime limits and blockers working against it.

At visz.ai, cookieless means it literally: there is no cookie access anywhere in the tracker. The snippet stores no first-party and no third-party cookies — there is simply no code path for it.

Recognition works differently: after consent, the tracker stores an anonymous, random ID in the browser's localStorage — per site (first-party), with no cross-site tracking and no fingerprinting. The ID is a random value, not a profile. Before consent, it is not created either.

And if the browser denies storage access? The tracker falls back to an in-memory ID that ends with the tab. The visit is still measured — as a single session, without recognition. That is the data-quality point: a cookieless snippet does not break when cookies are blocked, because it never needed any.

Now the part that dishonest marketing leaves out: cookieless does not mean consent-free. § 25 TDDDG covers any storing or reading of information on the device — the localStorage entry falls under it just like a cookie would. And session recordings require consent under Art. 6 GDPR anyway, entirely independent of the storage mechanism.

That is why visz.ai is built consent-first throughout: before consent there are zero events, zero recordings, zero fingerprints. A set “Do Not Track” signal stops tracking entirely — it wins against everything. The snippet is built to run behind a consent banner and supports Google Consent Mode.

In practice that means no extra effort: you wire up your existing banner via a single JS call (visz('consent', true)), via Google Consent Mode v2 — visz.ai reads analytics_storage — or entirely without code changes via a CSS selector pointed at your “Accept” button in the dashboard. Common consent platforms such as Cookiebot, Usercentrics or Borlabs Cookie work with it out of the box.

Anyone promising you “behavior analytics without a consent banner” is promising something that does not work cleanly in legal terms once recordings and recognition are involved. The honest phrasing is: fewer cookie hurdles — not zero obligations.

If the banner stays — what does cookieless actually buy you? Four things, all verifiable:

Cookieless is not a trick to route around the GDPR — it is an architectural decision that makes your tracking setup simpler, more robust and more data-minimal. Your visitors' consent remains the foundation; at visz.ai it is not an afterthought but the precondition for any data to flow at all.

Framed that way, it becomes an honest offer: a free behavior-analytics tool that works without cookies, captures nothing before consent, and uses your visitors' data for nothing but your analysis. Fewer hurdles — with full respect for the one hurdle that has to stay.