“Cookieless tracking” is used as a mood. In SiteLine it is a pipeline.
The browser snippet does not write a first-party analytics cookie. Unique visitors are computed on the server from an anonymised IP, the user agent, and a daily salt. Collect is fetch with keepalive and credentials: 'omit'. The raw IP is not stored on the event. Hostnames must match an allowlist. Bots are dropped.
That is the whole trick. It is not device fingerprinting sold as privacy, and it is not “we never see a network address.” The request still arrives at SiteLine servers run by Aglet Technologies. Details live on /docs/privacy and in the policy at /privacy.
What a cookie was doing that we do not do
Google Analytics 4 sets _ga / _ga_* on your domain (first-party) so the same browser can be recognised for months. The cookie is why EU ePrivacy rules usually demand a banner. It is also why “unique users last 30 days” looks smooth.
SiteLine never sets that cookie. If you open DevTools → Application → Cookies on a site that only uses this tracker, you should not see a SiteLine analytics cookie. (You may still see a CMS session, a storefront cart, or Stripe Checkout cookies. Those are not us.)
The siteline.tools app uses cookies: session, CSRF, theme/sidebar. Those keep you logged into the product. They are not issued to your visitors.
How the visitor id is built
On ingest, SiteLine:
- Takes the client IP (from the connection or forwarded headers if you proxy).
- Truncates IPv4 to /24 (
203.0.113.44→203.0.113.0) and IPv6 to /48. - Mixes that truncated address with the user agent string and a per-UTC-day salt that customers cannot read.
- Stores a SHA-256 hash as the visitor id.
Tomorrow the salt is different, so the same household is a new visitor. That is a product limitation, not a bug: we cannot offer GA4-style 30-day returning-user vanity metrics, and we will not pretend otherwise.
Truncation-then-hash is not the same as “IP anonymization” inside Google Analytics (which historically zeroed the last octet and still set a cookie). That comparison is IP anonymization vs cookieless analytics.
What the beacon contains
The tracker posts to POST /api/analytics/event (or your first-party proxy of that path):
public_idof the analytics site- event
nameandtype(pagevieworcustom) - URL, path, hostname, referrer
- UTMs present on the URL
- optional properties you attach (capped)
It does not send cookies, because credentials are omitted. Device, browser, and OS are parsed from the user agent on the server, not as extra fields the script invents. Country comes from request geography (for example CF-IPCountry) when present.
If you put emails or account ids in custom properties, that is your identified analytics. The cookieless id will not save you from having stored an email. Do not do that unless you mean to.
Why credentials: 'omit' matters
Cross-origin navigator.sendBeacon includes cookies by default. Laravel’s collect endpoint uses a permissive CORS origin. Sending SiteLine session cookies from a random website would be a mess. The tracker prefers keepalive fetch with credentials omitted so:
- Your siteline.tools login is not attached to a public collect POST.
- The customer site does not need to participate in a cookie-based identity.
sendBeacon with text/plain is last-resort only. Implementation notes live with the tracker; the privacy-relevant part is: no analytics cookie, no credentialed collect.
What cookieless does not mean
Not anonymous. GDPR and the Australian Privacy Act can still treat this as personal information. See GDPR analytics without a consent banner and Analytics and the Australian Privacy Act.
Not EU-resident. Events go to SiteLine. Stripe (billing) and Cloudflare (email/edge) are subprocessors. Hosting region is not a marketed EU-only SKU.
Not immune to ad blockers. Blocklists target /js/script.js and known collect paths. A customer-configured first-party proxy (nginx, Caddy, Cloudflare, Vercel; no managed CNAME in v1) can improve survival. Proxied events are still SiteLine events.
Not a consent holiday for other tags. Consent-free analytics refers to this cookie model.
Retention: analytics while you are subscribed ($4.99 / $19.99 / $99.99 USD, 7-day trial) plus 30 days’ grace, then purge. Search Console stays while the account exists. Questions: [email protected].
FAQ
Can I see the daily salt or reverse a visitor hash?
No. The salt is not customer-visible. Hashes are one-way. We also do not store the raw IP on the event, so there is no column to “de-anonymise” in the dashboard.
Does cookieless tracking use browser fingerprinting APIs?
No canvas, audio, WebGL, or font enumeration from the SiteLine snippet. The id is truncated IP + user agent + daily salt. Coarse device hints come from the user agent string.
Will unique visitors match Google Analytics 4?
No, and they should not. GA4 cookies persist; SiteLine ids reset daily; bots are filtered differently; ad blockers bite third-party collect harder unless you proxy. Compare trends, not absolute uniques.