# Cookies and cookieless tracking

Attriboo's standard website tracker uses a first-party cookie and local storage to remember a browser. For daily pageview totals without browser storage or visitor identifiers, choose Cookieless in Settings → Privacy & data and publish the c.js code from Setup. Blocking cookies alone does not make this tracker cookieless, because local storage can retain the identifier.

Canonical page: https://www.attriboo.com/docs/cookies-and-cookieless-tracking

Instructions reviewed: 2026-10-31

## Browser records on a tracked website

Cookie expiry and local-storage lifetime are different. Deleting only the cookie can leave the ID in local storage, and the tracker can use that copy to create the cookie again. Browser exclusions are a reporting control; the tracker may create identifier storage before applying the exclusion, so they are not a replacement for consent controls.

| Record | Purpose | Lifetime |
| --- | --- | --- |
| _atb_vid cookie | Recognizes a browser. Normally shared across the website's root domain and its subdomains. | Up to 365 days, refreshed on page load when the tracker runs; browsers may remove it sooner. |
| _atb_vid local storage | Keeps a copy of the browser ID on the current origin. | No built-in expiry. Remains until removed by the site, visitor or browser. |
| _atb_root test cookie | Finds the root domain that accepts a shared cookie when no domain override is supplied. | Set briefly and removed during detection; has a 10-second maximum age. |
| _atb_ignore cookie and local storage | Remembers a browser exclusion when the exclusion link is used. | Cookie: up to 365 days. Local storage: until removed. |
| _atb_cart session storage on Shopify | Avoids repeatedly tagging the cart with the same visitor ID in a tab. | The tab's session. |

## First-party does not mean consent-free

First-party describes where a cookie is set. It does not establish a legal exemption. Cookie and similar-technology rules can cover local storage, link decoration and other device access too. Assess the actual purpose and applicable rules, including any narrow exemptions, before deciding whether consent is required.

The UK has a statistical-purposes exception with conditions. Do not assume visitor identification and payment-linked revenue attribution qualify just because they produce statistics. EU member-state rules and other countries' requirements also differ.

- [ICO rules for cookies and similar storage technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/)
- [ICO conditions for storage and access exceptions](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)

## What cookieless would change

Cookieless is a description of a particular implementation, not a guarantee of anonymity or compliance. A tool that avoids persistent identifiers generally has less information for connecting a first visit to a sale weeks later. Other identifiers or device access still need their own privacy assessment.

Standard tracking uses t.js and a persistent browser ID. Cookieless c.js records daily pageview totals. You can explicitly add daily visitor estimates in Privacy & data and publish the updated snippet. That option uses temporary server-side IP/browser signatures; it is off by default. Neither cookieless option records page paths or sources, recognizes people across days, or matches visits to payments. Open the Cookieless traffic report from Privacy & data to read totals and estimate coverage. Payment-provider connections can still send customer records separately.

Switching modes does not erase earlier data. Review existing storage and records, replace the old script, and keep one installation. In WordPress, choose the same measurement mode and daily-estimate option in the plugin. Disabling email capture or third-party cookies alone does not switch modes.

- [Set up daily cookieless visitor estimates](https://www.attriboo.com/docs/cookieless-visitors)
- [Ask about a tracking or cookie requirement](https://www.attriboo.com/support?topic=cookies)

## Attriboo's website has its own cookie choices

Cookie settings in Attriboo's footer controls optional analytics on Attriboo's own website. It does not configure consent on your separate website. Attriboo's own site also uses storage for requested functions such as sign-in, appearance and remembering cookie choices. Those records are listed in its Cookie Policy.

- [Read the Cookie Policy for Attriboo's website](https://www.attriboo.com/legal/cookies)

## Related guides

- [Set up and test cookie consent](https://www.attriboo.com/docs/markdown/cookie-consent.md)
- [What data does Attriboo track?](https://www.attriboo.com/docs/markdown/tracking-data.md)
- [GDPR and privacy checklist for your website](https://www.attriboo.com/docs/markdown/gdpr-and-privacy.md)