Count daily visitors without analytics cookies
Attriboo can estimate distinct visitors within each UTC day without analytics cookies or browser storage. This is an optional addition to cookieless pageview totals. It uses temporary server-side request signatures and does not recognize returning visitors across days or match traffic to payments.
Instructions reviewed
Enable estimates for your website
The saved website option and the published script attribute are both required. Saving a dashboard choice alone does not change an old snippet. Without the attribute, it continues counting pageviews only.
- Save cookieless mode.
Open Settings → Privacy & data, choose Cookieless under Measurement mode and select Save privacy settings.
- Review the additional processing.
Under Daily cookieless visitor estimates, select Estimate distinct visitors each UTC day. Read the IP/browser processing explanation, acknowledge your notice/consent review, and select Save visitor estimates. The setting is off by default.
- Publish the updated installation.
Open Setup, choose your platform and replace the old installation with the new c.js code. It includes data-visitor-estimates="daily". Keep one script installation. On WordPress, update to plugin 1.4 or later, choose Cookieless and enable Estimate daily cookieless visitors in the plugin too.
- Test the actual consent choice.
Apply your consent manager's real saved choice on every page. After permission, open several pages in one browser and inspect the Cookieless traffic report. Rejection/withdrawal and GPC/DNT keep the browser tracker off.
What the server uses
The collector uses trusted Vercel request information: the IP address and browser user-agent, plus your website ID and a cryptographically random secret for the current UTC day. It computes a keyed SHA-256 signature in server memory. Raw IP and user-agent strings are not sent as database RPC arguments or stored as analytics fields by this feature. Hosting/security processing still receives network requests.
The browser sends the website ID and its daily-estimate choice. It does not send a persistent visitor ID, read/write cookies or browser storage, or collect canvas/screen fingerprint inputs. Server-side daily signatures are still a form of request-based identification; do not advertise this option as fingerprint-free or automatically anonymous. The standard tracking mode remains separate.
Read daily estimates and coverage
Example: one browser makes five pageviews today and three tomorrow with unchanged request information. The report can show one estimate on each UTC day, eight pageviews, and a sum of two daily estimates. It cannot identify that as one person across both days. Earlier pageview-only counts cannot be backfilled.
| Report value | Meaning |
|---|---|
| Pageviews in this period | All recorded cookieless pageviews in the displayed UTC range, including pageview-only installs. |
| Sum of daily visitor estimates | Daily distinct-signature estimates added together. This is not distinct people across the entire date range. |
| Pageviews eligible for estimates | The share of recorded pageviews that included enabled estimation and usable trusted request information. |
| Not collected | There were no eligible pageviews for that day's estimate. This does not mean zero people visited. |
Understand the estimate's limits
- People sharing an IP address and browser user-agent can be grouped together. A changed network, VPN, IP address or browser can split one person's activity.
- The daily secret changes at UTC midnight. Your website's local calendar day can overlap two UTC days. Standard reports can use other date settings; compare like-for-like windows.
- Requests without trusted IP/browser information still count as pageviews but do not create an invented visitor. Bot classification and blocked requests also affect coverage.
- The cookieless report has daily totals, not page/referrer/campaign breakdowns or buyer journeys. Payment integrations can still import customer records independently.
Review retention and privacy
Temporary signatures are stored privately for daily deduplication. The hourly privacy job removes prior-day signatures in bounded batches and deletes prior-day keys. Failed or backlogged cleanup needs operator attention; UTC rotation does not itself delete stored records. Protected provider backups follow separate handling.
Aggregate daily totals remain until website deletion or a separate removal arranged through support. The identifiable-analytics retention setting does not erase these totals. Turning estimates off stops new estimation and keeps the recorded totals.
Describe this optional request-based processing in your notice and assess the applicable lawful basis, consent and objection requirements. Cookieless does not itself establish a legal exemption. The pure pageview-only option remains available without daily signatures.
You are done when
Daily estimates appear alongside pageviews and eligible-pageview coverage after both the website option and updated script are enabled.
Still need a hand?
Send a question without needing to sign in.