Learn when cookie-free measurement still accesses a device, what remains measurable, and how to assess light mode before implementation.
Cookieless analytics is website measurement that does not set or read cookies. The related term cookieless tracking covers different technical approaches, including server-side aggregation and browser-based methods. The label describes the absence of cookies, not whether the setup is consent-free, anonymous or compliant by default.
It depends on the technical implementation. § 25 TDDDG concerns storing information on an end device or accessing information already stored there, not cookies alone. Consent may therefore still be required when another method performs that access, unless a statutory exception applies. The specific setup should be assessed legally.
Replacing cookies with localStorage, sessionStorage, IndexedDB or a similar browser mechanism does not avoid the core issue under § 25 TDDDG. Fingerprinting techniques may also involve device access. Review what the script reads, writes and combines rather than relying on a vendor’s “cookieless” label.
No. Server-side tracking only describes where data is processed. If the server sets a first-party cookie or receives an identifier stored in the browser, the setup still involves the end device. A genuinely storage-free approach sends only the data needed for aggregation without placing a persistent recognition marker on the device.
You can generally measure aggregate pageviews, landing and exit pages, referrers, channels, device categories, approximate regions, clicks, scroll depth and configured Events. Heatmaps and Rage Clicks may remain possible when they are based on aggregated interactions rather than persistent visitor profiles.
You cannot reliably recognise the same person across visits without a persistent or otherwise linkable identifier. This limits returning-visitor analysis, cross-session cohorts, multi-touch attribution and visitor-level scoring. Session Replays and other features that depend on linking interactions may also be unavailable.
BigHoot light mode does not use cookies, localStorage or sessionStorage, and identifier-dependent features are disabled. That reduces device-access concerns but does not remove every obligation. If personal data such as an IP address is processed, you still need to assess the GDPR legal basis, transparency, data minimisation, retention and processor terms.