In this guide
- Cookieless almost never means "no identifier at all". It means not depending on third-party cookies.
- Four methods do the work: first-party storage, server-set cookies, consented identifiers such as a hashed e-mail, and modelling for the gaps.
- Being cookieless does not remove consent rules. In the EU and UK, storing or reading an identifier on a device still needs a lawful basis.
"Cookieless" is used in two different ways, and they get mixed up. Some people mean no third-party cookies, the cookies set by an advertising network on a page that is not its own. Others mean no cookies at all. The first is real and common. The second is rare, and only possible for coarse measurement. This page explains the methods, the trade-offs and what to do with them. It builds on third-party cookies and tracking cookies.
Why the topic exists
Third-party cookies have been blocked by default in Safari and Firefox for years. Chrome has kept them available and added user-choice controls instead of removing them outright, but ad blockers, privacy modes and consent banners mean a growing share of visits cannot be followed with them. Marketers want to know which ad led to which sale without depending on a single browser setting.
3 things to remember
Scroll and the points stack up.
Cookieless almost never means "no identifier at all". It means not depending on third-party cookies.
Four methods do the work: first-party storage, server-set cookies, consented identifiers such as a hashed e-mail, and modelling fo
Being cookieless does not remove consent rules. In the EU and UK, storing or reading an identifier on a device still needs a lawfu
Method 1: first-party storage
A first-party cookie or local storage entry belongs to your own domain. Most analytics tools moved to this years ago. The limit is that Safari caps the lifetime of cookies written by JavaScript, so a returning visitor after a week can look new. See Safari ITP.
Method 2: cookies set by your own server
A cookie set in an HTTP response from your own subdomain can live longer than one set by a script. This is the main reason teams add a server container. In Open Tracked, Cookie Keeper goes one step further: it keeps the platform cookies (for example _fbp) on your tagging server, under a hash of an identifier such as the customer ID, and gives them back when the same visitor returns without them. Cookie Keeper is on every plan, including Free, and it needs the Data Store.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
Method 3: consented identifiers
When a visitor logs in, subscribes or buys, you have an e-mail address or phone number. Hashed and sent with consent, it lets Meta, Google and TikTok match the event to a person without any cookie. This is the idea behind Meta's event match quality and Google's enhanced conversions. The Open Tracked Data Store and Enricher remember the hashed values for the days you choose (up to 400) and add them to later events from the same browser, so a returning visitor who only browses still reaches the platform with a good match. See Meta event match quality.
Method 4: modelling
Where no identifier is available, platforms estimate. Google's Consent Mode fills gaps with modelled conversions when visitors decline cookies, and Meta uses aggregated event measurement and statistical modelling. Modelled numbers are useful for bidding but you cannot audit a single order from them.
| Method | Identifier used | Needs consent in the EU/UK? | Strength | Weakness |
|---|---|---|---|---|
| First-party storage | Cookie or local storage on your domain | Yes, except strictly necessary | Simple, works everywhere | Short life in Safari |
| Server-set cookies | Cookie set by your server | Yes | Longer life | Needs a server and your own subdomain |
| Consented identifiers | Hashed e-mail or phone | Yes | Survives cookie loss | Only after the visitor gives it |
| Modelling | None for that visit | The consent state decides | Fills gaps | Estimates, not facts |
What you lose without cookies
- Long view of anonymous visitors. A first-time visitor who comes back after weeks as a different "person" cannot be joined up.
- Cross-site retargeting from third-party cookies. Platforms build audiences differently now, mostly from your first-party data.
- Exact multi-touch paths. Journeys become shorter and rely more on the last click and on logged-in data.
A practical plan
- Collect a first-party identifier with consent: log-in, newsletter or checkout e-mail.
- Send events from the server with a stable event ID, so browser and server events deduplicate. See event deduplication.
- Keep the platform cookies alive from your server, with Cookie Keeper or an equivalent.
- Use Consent Mode so Google can model what it cannot see. See Consent Mode v2.
- Judge ad results with your own revenue, not only the platform's attribution.
Terms you will see
- First-party cookie
- A cookie set for your own domain, for example
yourstore.comortrack.yourstore.com. - Third-party cookie
- A cookie set by a domain other than the one in the address bar, for example an ad network's domain on your page.
- Identifier
- Any value that tells one visitor from another: a cookie ID, a hashed e-mail, a device ID or a customer number.
- Hashed e-mail
- An e-mail address passed through a one-way function (SHA-256) before it is sent. Platforms can compare hashes without seeing the plain address.
- Modelled conversion
- A conversion the platform estimates with statistics when it cannot observe the full path.
- Consent Mode
- Google's way of telling its tags what the visitor allowed, so tags adjust their behaviour and fill gaps with modelling.
How to tell whether your site is ready
Three mistakes that make cookieless plans fail
- Waiting for the perfect identifier. There is not one. Collect e-mail at checkout today and improve later.
- Sending identifiers without consent. A server does not change the rules. A tag that should wait for consent must still wait.
- Trusting one platform's number. Platform attribution is modelled. Your own order data is the check.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Frequently asked questions
Is cookieless tracking legal without consent?
No, not automatically. Consent rules depend on whether you store or read an identifier on the device and on what you do with the data. Coarse, aggregated measurement without identifiers is treated differently from personal tracking.
Is server-side tracking cookieless?
No. It uses first-party cookies set by your own server. It reduces the dependence on third-party cookies, but identifiers are still used.
What replaces third-party cookies for ads?
First-party data you collect yourself (e-mail, phone, purchase history), platform modelling, and server-side events with good identifiers.
Does cookieless tracking hurt accuracy?
It changes it. You see fewer anonymous multi-visit journeys and more modelled numbers. Accuracy for logged-in and purchasing visitors can stay high.
What should a small store do first?
Set up the Conversions API next to the pixel with a shared event ID, collect e-mail at checkout, and move cookies to a server container.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 5 min read
