How Cookieless Tracking Actually Works (And Why Your Numbers Look Different)

Before we can understand cookieless tracking, we need to understand what cookies do in the first place. A cookie is a small text file that acts as your digital name tag. It’s how analytics tools recognize “this is the same person who was here 30 seconds ago.”

Think of how you use the internet. You visit a site a few times over the course of a month and then fill out the contact form to get in touch.

If you need to explain this to other people, this is the analogy I use:

With a cookie: Analytics sees one visitor who viewed 4 pages over the course of several sessions and converted.

Without a cookie: Analytics sees a separate visitor every time you visited the site, and that last visitor also converted.

It’s like the difference between wearing a name tag at a conference versus showing up to each session as a complete stranger. The name tag lets people build a continuous picture of who you are and what sessions you attended. Without it, you’re starting fresh every time.

What is cookieless tracking? Cookieless tracking identifies website visitors without storing persistent cookies on their devices. Instead, tools use temporary identifiers—like hashed combinations of IP address and user agent—that can’t be used to track individuals across sessions or days.

Here’s where things can get tricky. Cookieless tracking doesn’t mean “no visitor identification at all” as different tools handle it very differently. Understanding the mechanics helps you know what your data actually represents.

How Plausible Handles Visitor Identification

Plausible uses your IP address combined with your User Agent (what kind of browser you’re using), run through a hash function with a daily rotating salt. This creates an anonymous identifier that can recognize “same visitor” within a single day.

What is hashing? Hashing is a one-way process that transforms data into a scrambled string of characters. Think of it like a blender—you can turn fruit into a smoothie, but you can’t turn that smoothie back into individual fruits.

What is a salt? A salt is a random value that gets mixed in before the hashing happens, so even if two people have the same IP address and browser, their hashed identifiers come out differently. This makes it essentially impossible to work backwards and figure out who someone was.

The salt changes every 24 hours, and old salts are deleted immediately. This means that there’s no way to connect a Tuesday visitor to the same person on Wednesday. The raw IP and User Agent are never stored anywhere.

The result:

• Same visitor, 5 page views in one day = 1 unique visitor.
• Same visitor on 5 different days = 5 unique visitors.

The key limitation here is that Plausible can’t show “New vs Returning visitors” or do any kind of retention analysis. That’s a deliberate trade-off for privacy.

How Matomo Handles Cookieless Mode

When you enable cookieless mode in Matomo, it uses what they call a “config_id”—a hashed fingerprint of environmental information, similar in concept to Plausible.

But the default lookback window is only 30 minutes. This means if someone visits in the morning and comes back in the afternoon, they might be counted as two different visitors. Matomo warns that increasing the lookback period is “computationally expensive” and can slow things down.

Matomo also supports a hybrid approach: cookies for consented visitors, cookieless for everyone else. This can be useful in certain configurations.

Let me give you a concrete example. Imagine the same person visits your site at 9am and again at 3pm:

• Plausible: Counted as 1 unique visitor (same day)
• Matomo (default cookieless): Likely counted as 2 visitors (outside the 30-minute window)
• GA4 (with consent + cookies): Counted as 1 unique visitor

These are deliberate trade-offs made to accommodate the competing priorities of tracking and privacy. Each tool made different choices about how to implement privacy versus measurement accuracy, and your circumstances might be different in terms of which trade-off matters more.

GA4 has a feature called behavioral modeling that tries to estimate what non-consented users did based on patterns from consented users. I’m not a big fan of relying on this for decision-making, and here’s why.

How it works: GA4 looks at what consented users do and then uses machine learning to estimate what non-consented users probably did based on similar patterns.

The catch is that you need significant traffic thresholds before modeling kicks in. Specifically, you need at least 1,000 users per day who consent AND 1,000 users per day who decline, for 7 of the last 28 days. In my experience, many sites don’t hit these thresholds, especially if your consent banner isn’t prominent or if people are ignoring it entirely.

Even when modeling is active, it’s still an estimate, not an actual measurement. And here’s an important nuance: modeling only affects what you see in GA4’s reports. Modeled data is never sent to Looker Studio or BigQuery. If you’re building dashboards from exported data, you’re only seeing observed data.

However, you can toggle between “Blended” (includes modeling) and “Observed” (only actual data) in your reporting identity settings under Admin. You might consider switching to “Observed” so the data doesn’t suddenly change when you qualify for modeling. Otherwise, your reports in GA4 will suddenly look very different without warning!

If you’re trying to get modeling working, I wrote a separate guide on how to verify your consent signals are working correctly in GA4.

So if cookieless tools measure everyone without stitching across days, and GA4 measures consented users plus some machine learning guesswork, what happens when you compare them side by side?

GA4 with consent mode typically only shows you data from people who said “yes” to tracking, unless you qualify for modeling, which most sites don’t. Plausible shows everyone who visited, regardless of consent choice, because it doesn’t require consent in the first place.

The result: Plausible will almost always show higher numbers than GA4.

But this variance does give us a useful insight: the difference between the two is roughly your consent denial rate plus people who ignore the banner entirely.

What Metric to Actually Compare

If you are comparing between Plausible and GA4, I wouldn’t look at sessions or users. Instead, I’d look at page views.

Plausible records a page view for every page view, period. GA4 only records page views from consented users. The difference between these two numbers gives you a rough sense of how much traffic you’re “missing” in GA4.

Some consent management platforms (such as Cookiebot) provide stats on consent rates, but not all of them do. Other factors like ad blocker usage and differences in bot filtering also contribute to the gap between the two tools, but in my experience, consent rates are usually the biggest driver.

Keep in mind that unique visitor counts will have additional variance beyond consent rates. GA4 with cookies can recognize the same person coming back a week later, while Plausible can only recognize them within the same day. Over a month, Plausible might show “higher” unique visitors partly because returning visitors get counted multiple times (once per day they visit).

Neither number is “wrong”. Instead, they’re answering different questions. This is similar to what happens with discrepancies between Google Analytics and Google Ads, which is completely normal and expected once you understand what each tool is measuring.

Understanding these mechanics helps you decide which tool to trust for which questions and (hopefully!) stops you from chasing phantom data discrepancies.

Match the Tool to the Question

Use Plausible or another cookieless tool for:

• Daily traffic trends
• Page-level popularity
• Privacy-compliant volume estimates
• “How much traffic did we get today/this week”

Use GA4 or Matomo with cookies for:

• Attribution path analysis
• Retention and returning visitor analysis
• “How long does it take a user to go from first visit to purchase?”

Know What You Can’t Get from Cookieless Tracking

There are some questions cookieless tracking genuinely cannot answer:

• New vs. returning visitors
• Multi-day user journeys
• Retention cohorts
• “Did our email campaign bring people back?”

If these questions matter for your business, you’ll need a cookie-based solution for the users who consent, and you’ll have to accept that you can’t track users who don’t consent to tracking.

Consider a Hybrid Approach

Some teams in strict consent regions run GA4 purely for remarketing to non-EU traffic, while using Plausible for all their analytics reporting. This gives privacy-compliant measurement for European visitors while maintaining full capabilities elsewhere.

Matomo specifically supports tracking consented users with cookies and non-consented users without cookies (cookieless)—all in the same implementation. This can be a useful middle ground.

Governance Considerations

If you’re reporting to stakeholders, pick one source of truth for each metric and stick with it. Don’t switch between tools based on which number looks better because that is a very fast way to lose credibility. Document which tool you use for which questions so everyone’s comparing the same thing.

If you’re unsure where to start, an audit of your GA4 setup can help you understand what’s configured correctly and what might be causing confusion in your reports.

Remember: there isn’t one analytics tool that can solve everything! Instead, you need to pick the options that make the most sense for you, considering the privacy trade-offs.

The key is knowing what questions each tool can answer:

• “How much traffic did we get today?” → Cookieless will work
• “How many of last month’s visitors came back?” → You need cookies
• “Where did our converting users originally come from?” → Cookieless if same day; cookies otherwise

If your numbers look different between tools, that’s expected. Now you know why.

Your circumstances might be different, but I hope this helps you make sense of what you’re seeing in your own dashboards!

Have questions about this? Check out my related YouTube video, and drop your questions in the comments!