Analytics without a cookie banner
Banner-bound tracking loses data the moment visitors decline — and often moves it to the US. Cookieless analytics from the EU measure completely, without a consent banner and without tracking cookies. The same platform also delivers uptime, performance and compliance.
We use cookies
Tracking only after consent
of sessions missing from banner rejection
tracking cookies and local-storage entries
EU measurement nodes: Nuremberg, Falkenstein, Helsinki
modules in one platform instead of tool sprawl
Why banner-bound tracking costs data and trust
Cookie-based analytics services require consent to set non-essential cookies. In practice that means a consent banner that many visitors dismiss or decline. Every rejection is a gap in the data — real-world figures and publicly discussed estimates often sit at 30 to 60 percent of sessions uncaptured. Decisions about content, campaigns and conversion optimisation then rest on a distorted sample.
The problem intensifies exactly where it matters. Those who decline often do so before the first conversion is measured — so the very visitors who are purchase-ready and privacy-aware are missing from the most important analyses. A funnel that knows only half of the sessions overstates bounce rates and underestimates successful paths. Campaign reports become guesswork rather than a foundation.
Then there is the data location. If data is transferred to the US, additional legal bases and risk assessments are required, and sub-processor chains have to remain documented. Cookie banners, privacy policy and data processing all need maintaining — effort that recurs with every tool change. The legal assessment in each case remains with you, but the direction is clear: less third-country transfer means less burden of justification.
What TDDDG section 25 has to do with the banner requirement
The frequently cited trigger for the banner is not primarily the GDPR but TDDDG section 25: it requires consent as soon as information already stored on the device is accessed, or information is stored there. That is precisely what happens when tracking cookies are set and read. Anyone who neither stores nor reads such information usually does not fall under this consent requirement for plain traffic measurement.
Cookieless analytics therefore invert the logic: instead of re-identifying a person via an identifier across days, XICTRAQ evaluates privacy-friendly, aggregated signals. Each day, a short-lived, non-resettable session signal is formed from coarse factors such as geo region and device class — just enough to keep a single session coherent, but not to follow a person across devices or across days. The IP address only serves to derive the country and is then discarded.
This usually removes the banner requirement for plain traffic measurement — and traffic becomes fully visible again.
Honesty remains important: if you use optional features such as session recordings, a separate assessment of the legal basis may be advisable. The legal assessment in each case remains with you or your data protection officer.
Cookie tracking vs. cookieless in detail
Cookie-based (typical)
- Sets persistent tracking cookies and browser storage for re-identification
- Banner with a reject option usually required before any measurement
- Often US or undefined locations, frequently with sub-processors
- Re-identification of individuals via stable identifiers across sessions
- Rejected sessions are missing entirely — in practice often 30 to 60 percent
- Often a separate tool needed, decoupled from behavioural tracking
- Heatmaps and recordings frequently in their own third-party stack
- Masking often has to be configured manually, an error source
- DPA sometimes only in English, long sub-processor chains
- Pure analytics product, monitoring separate
XICTRAQ (cookieless)
- No cookies, no local storage — purely server-side, aggregated evaluation
- Usually not needed for plain traffic measurement
- Processing in the EU, measurement nodes in Nuremberg, Helsinki and Falkenstein
- No personal re-identification, IP only used for geo derivation and then discarded
- No banner-induced gap, traffic is measured completely
- Core Web Vitals (LCP, CLS, INP) as field data directly in the same dashboard
- Heatmaps, form analytics, funnels, A/B tests and recordings integrated
- Auto-redaction: input fields masked, IBAN/card patterns automatically redacted
- DPA under Art. 28 GDPR provided, no US transfer
- Part of 21 modules: uptime, SSL/DNS, security, accessibility, reports and more
| Feature | Cookie-based (typical) | XICTRAQ (cookieless) |
|---|---|---|
| Cookies / local storage | Sets persistent tracking cookies and browser storage for re-identification | No cookies, no local storage — purely server-side, aggregated evaluation |
| Consent banner | Banner with a reject option usually required before any measurement | Usually not needed for plain traffic measurement |
| Data location | Often US or undefined locations, frequently with sub-processors | Processing in the EU, measurement nodes in Nuremberg, Helsinki and Falkenstein |
| Personal data | Re-identification of individuals via stable identifiers across sessions | No personal re-identification, IP only used for geo derivation and then discarded |
| Data loss from rejection | Rejected sessions are missing entirely — in practice often 30 to 60 percent | No banner-induced gap, traffic is measured completely |
| Performance data | Often a separate tool needed, decoupled from behavioural tracking | Core Web Vitals (LCP, CLS, INP) as field data directly in the same dashboard |
| Behavioural analysis | Heatmaps and recordings frequently in their own third-party stack | Heatmaps, form analytics, funnels, A/B tests and recordings integrated |
| Input in recordings | Masking often has to be configured manually, an error source | Auto-redaction: input fields masked, IBAN/card patterns automatically redacted |
| Contractual basis | DPA sometimes only in English, long sub-processor chains | DPA under Art. 28 GDPR provided, no US transfer |
| Platform scope | Pure analytics product, monitoring separate | Part of 21 modules: uptime, SSL/DNS, security, accessibility, reports and more |
General category comparison; specific tools vary. Not legal advice.
What you still see precisely without cookies
Going cookieless does not mean going without insight. XICTRAQ measures pageviews, sessions and privacy-friendly estimated unique visitors, plus sources and campaigns including UTM parameters, devices, browsers, operating systems and countries as well as bounce rate and time on page. For performance, Core Web Vitals (LCP, CLS, INP) are captured as field data — measured on real visitors, not in a lab. So you see not only where traffic comes from, but also whether slow pages drive it away again.
On top of that, depending on plan, heatmaps, form analytics, conversion funnels, A/B tests and session recordings are available. Form analytics show at which field visitors abandon — often the decisive insight at checkout. Funnels reveal where sessions are lost between the product page and order completion. A/B tests are evaluated with a two-proportion z-test, so you choose a variant not on gut feeling but backed by statistics.
For session recordings — which are opt-in and off by default — input fields are masked automatically and sensitive patterns such as credit-card or IBAN-like strings are redacted before anything is stored. As a result, no plaintext input ends up in the recording. The recording library is served from your own domain, not from a third-party CDN, so no additional data flow to third parties arises.
Setup in a few steps
Add the website
Add the website in the dashboard and copy the single-line snippet with your site ID.
Embed the snippet
Place the first-party served script in the head — usually in under 60 seconds.
Data starts flowing
From the first pageview, sessions, sources and Core Web Vitals are captured.
Sharpen optionally
First-party proxy against content blockers, recordings via attribute, fine settings server-side.
Integration is via a single-line, first-party served script in the head of your site — usually set up in under 60 seconds. You add the website in the dashboard, copy the snippet with your site ID and paste it in. Data starts flowing from the first pageview. Common shop systems such as WooCommerce, Shopify, Shopware, PrestaShop and JTL are detected automatically, so orders, revenue and cart events are captured without extra configuration.
What to watch for: anyone with an aggressive content blocker in their market should set up the optional first-party proxy over their own domain. The tracker is then served under a path on your domain instead of via a separate tracking domain — so it is not caught by filter lists that target domain or file names. Fine settings such as sample rate, excluded URLs or additional masking rules are maintained server-side in the website settings, not in the snippet, so the served script stays lean.
You enable session recordings deliberately via an attribute, since they are opt-in. This makes the decision an active one that you can tie to your privacy documentation. Anyone running their own consent management can set a consent gate via the JS API and arm tracking only after agreement.
Analytics is just one of 21 modules
Uptime monitoring
Multi-node consensus from three EU nodes
API monitoring
Endpoint checks with assertions
Browser monitoring
Real click paths with assertions
Heartbeats
Cron watchdog with duration anomaly
Reporting & status page
Reports plus public status pages
Security scan
Headers, SSL, safe browsing and tech stack
Script integrity
Hash watch against Magecart skimming
Brand protection
Look-alike domains and CT-log watch
Visual changelog
Screenshot diff and defacement detection
CRA cockpit
Component inventory and CRA deadlines
GDPR compliance
Pre-consent cookie scan and imprint
Accessibility (BFSG)
Automated WCAG 2.2 AA checks
NIS2 readiness
Self-assessment and reporting deadlines
Cookieless analytics
Reach, funnels and performance
SEO monitoring
On-page signals and visibility
AI visibility
Share of model and crawl-to-visitor ratio
Geo API & tools
IP geo, ASN, datacenter and VPN/proxy
DNS & domain
DNSSEC, SPF/DKIM/DMARC and expiry
Alerting
Seven channels, escalation and quiet hours
AI assistant
Chat assistant for monitoring and guidance
Team & access
Roles, tenants and white-label
Pure analytics tools solve exactly one problem and leave the rest open. XICTRAQ bundles 21 modules in one platform: alongside cookieless analytics there are uptime monitoring, SSL and DNS monitoring, security scans, accessibility checking under the German BFSG, browser monitoring with assertions, SEO monitoring and reporting. So when a campaign brings traffic, you see in the same dashboard whether the page reliably delivers it.
Availability is checked from three EU measurement nodes — in Nuremberg and Falkenstein in Germany and in Helsinki in Finland. An outage only counts as an incident once several nodes confirm it independently (multi-node consensus), which reduces false alarms from local network issues. If a site goes down, an automatic diagnosis starts that classifies DNS, TLS, HTTP status and response time, so you do not begin troubleshooting from scratch.
For external proof, the platform produces SLA reports with availability rate and MTTR, the mean time to recovery. Browser monitoring runs real click paths with assertions and thereby checks whether a login or checkout actually works — not just whether the home page responds. A data processing agreement under Art. 28 GDPR covers the processing contractually. The legal assessment in each case remains with you.
Frequently asked questions
Can cookieless analytics really run without a consent banner?
Traffic measurement in XICTRAQ sets no tracking cookies and uses no browser storage; visits are told apart by a pseudonymous daily identifier, and the IP address is not stored. For plain traffic measurement, a consent banner under the German TDDDG section 25 is therefore usually not required, because no access to information already stored on the device takes place. However, once you use optional features such as session recordings, you should assess the legal basis separately. The legal assessment in each case remains with you or your data protection officer.
How does measurement work technically without a unique identifier?
Instead of re-identifying a visitor via a cookie across days, the server forms a pseudonymous daily identifier as a hash of the IP address and a random value generated anew each day, which is deleted once the day is over. This identifier keeps a session together within the day without following a person across days. The IP address is used only for this identifier, the approximate location, the internet provider, the detection of automated access and, for at most one minute, to limit the number of requests, and is not stored.
How big is the data loss from a banner in concrete terms?
It depends heavily on industry and audience. Real-world figures and publicly discussed estimates often sit between 30 and 60 percent of sessions rejected or dismissed. A shop with 100,000 visitors per month loses around 45,000 sessions from the analysis at a 45 percent rejection rate — and with it any reliability in funnel and campaign analysis. Cookieless still measures these sessions completely.
Which metrics do I still see?
Pageviews, sessions, privacy-friendly estimated unique visitors, sources and campaigns including UTM parameters, devices, browsers, operating systems, countries, bounce rate and time on page. Plus Core Web Vitals as field data and, depending on plan, heatmaps, form analytics, conversion funnels, A/B tests and session recordings.
How are session recordings kept privacy-friendly?
Recordings are opt-in and off by default. When enabled, input fields are masked automatically and sensitive patterns such as credit-card or IBAN-like strings are redacted before anything is stored. As a result, no plaintext input ends up in the recording. The library is served from your own domain, not from a third-party CDN.
How do I install the tracker and how long does it take?
Via a single-line, first-party served script in the head, usually set up in under 60 seconds. Common shop systems such as WooCommerce, Shopify, Shopware, PrestaShop and JTL are detected automatically, so orders and revenue are captured without extra configuration. An optional first-party proxy over your own domain ensures the tracker is not blocked by content blockers.
Where is the data stored and which nodes are involved?
Processing takes place in the EU. The measurement nodes are located in Nuremberg and Falkenstein in Germany as well as in Helsinki in Finland. Helsinki is therefore an EU location in Finland, not in Germany. A data processing agreement under Art. 28 GDPR is provided, and no US services are used for the analytics.
Are the numbers even comparable without cookies?
Since no banner clicks sessions away, traffic is captured completely — many operators see higher and more consistent numbers than with banner-bound tracking. Unique-visitor counting is a privacy-friendly estimate rather than a device-precise identification. Anyone who previously measured with cookies should treat the switch not as a 1:1 comparison but as a new, more complete baseline.
Where are the honest limits of cookieless analytics?
A cross-device journey of the same person over weeks is deliberately not represented — that is by design. Highly granular individual profiles do not arise. Anyone needing person-level ad attribution or long-term cohorts of individual users will hit limits here. For reach, source evaluation, conversion funnels and performance, however, the data basis is complete and reliable.
What does it cost and is there a free entry point?
A permanently free plan covers uptime monitoring for one website. Analytics are included from the Starter plan at 12 euros per month, cancel monthly, and are part of the same platform with a total of 21 modules, so monitoring and analysis are not scattered across separate tools.
Related features in detail
Measure completely — no banner, from the EU
Start with cookieless analytics and uptime monitoring in the same platform. Permanently free plan, analytics from the Starter plan at 12 euros per month, cancel monthly.