Cookieless analytics: is your website bringing in clients?

You can find out whether your website brings in clients without following people from site to site. For a small business, three numbers are enough: where visitors come from, which pages they read, and how many tap "Call," WhatsApp or send the form. All of them can be counted with an analytics tool that doesn't put cookies in the browser.

Why cookies matter here

Article 5(3) of the EU ePrivacy Directive says you can store information on someone's device, or read it from there, only with their consent, after telling them clearly why. The exceptions are narrow: what's needed to carry the communication, and what's strictly necessary for the service the person asked for. Visitor statistics don't automatically qualify.

That has a practical side effect few people mention: with a classic cookie-based tool, anyone who clicks "Reject" on the banner disappears from your numbers. Sometimes a big share of visitors is missing, and the report looks great while being wrong.

Some regulators accept analytics without consent under strict conditions. France's CNIL, for example, exempts audience measurement from consent if it's used only for that, the data isn't combined with other processing, the IP address is truncated, trackers last no more than 13 months, and people are informed and can opt out. The CNIL itself warns that interpretation can differ between countries, so this isn't an EU-wide rule.

What we use

On our own sites we use Umami, hosted on our own server. Its documentation says it measures visits without cookies, without cross-site tracking and without automatically collecting personal data. Since it runs on our machine, the numbers don't go to a third party.

No cookies doesn't mean no obligations. Your privacy policy still has to say what you measure. And if the same page has an embedded YouTube video, an ad pixel or a chat widget from another company, those can set cookies and the banner question comes back. We covered banners in our article on cookie consent.

The three numbers that matter

1. Where people come from. Google, Instagram, your Google Maps profile, people who typed your address. To tell one post from another, add UTM parameters to the link: utm_source, utm_medium and utm_campaign. Google recommends always using all three and points out that values are case sensitive: instagram and Instagram show up as two different sources. Decide once how you write them and stick to it.

2. Which pages they read. If a service page gets lots of visits and no inquiries, the problem is on the page: unclear pricing, a hidden button, weak photos.

3. What they do at the end. Mark as events the tap on your phone number, the WhatsApp button and the form submission. Give them names you'll still understand six months from now:

How to read the numbers

Look once a month, not every morning. Compare with last month, and with the same month last year if you have it. On a small site the numbers are small: 40 visits and three calls in a week is useful information, not a failure. And keep asking on the phone, "How did you hear about us?" The answer fills in what no analytics tool sees.

What you won't see

You won't get a profile of each visitor or lists of people to retarget with ads. If you run large paid campaigns that need that data, you'll need other tools and explicit consent. For a business that wants to know whether the site brings in calls, cookieless analytics is enough. If you want us to set it up on your site, see our marketing services.