What a cookie actually does, and why removing it changes the method
A tracking cookie's job is simple: it is a note left in the visitor's browser so the next request can be matched to the previous one. Remove the cookie and that note disappears -- so a cookieless tool has to recognise a returning visitor using only what arrives with each individual request, re-derived fresh every time rather than looked up from storage.
Hashing: turning a visitor into a number nobody can reverse
On each page view, a cookieless tool takes a few request details, such as a truncated IP address, user agent, and the site's domain, combines them with a secret that changes on a fixed schedule, and runs the result through a one-way hash function (commonly SHA-256). A hash function always produces the same output for the same input, which is what lets two requests from the same visitor on the same day resolve to the same value -- but it cannot be run backwards: you cannot take the hash and recover the IP address or any other input that produced it. That one-way property is the whole privacy argument: the tool gets a number useful for counting, not an identifier useful for identifying anyone.
Why the salt rotates daily
The secret mixed into the hash (the "salt") is rotated, typically every 24 hours. That single design choice does two things at once: it means the same visitor produces a different hash tomorrow, so no long-term fingerprint of one person accumulates across days or weeks, and it caps how long any one hash could theoretically be useful even if someone captured it. The trade-off is explicit and intentional: a visitor who reads an article today and returns in three days looks like two separate "new" visitors in daily reports, because cross-day identity is exactly what the rotation is designed not to preserve.
Where this leaves session and visitor counts
Within a single day, the rotating hash is stable enough to group a visitor's page views into one session, so page-per-session and basic engagement numbers hold up. Across days, cookieless tools report real, counted sessions rather than a persistent individual journey -- good enough to know that traffic from a campaign is converting, not precise enough to say "visitor #4821 came back on day nine." For most small businesses that trade-off is the right one: you are optimising pages and campaigns, not building an individual profile, which is also the activity GDPR is actually concerned with regulating.
Why regulators treat this differently from cookie tracking
GDPR's own text draws the line at identifiability. Recital 26 of the Regulation states that its rules do not apply to "information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable." A one-way, daily-rotating hash that cannot be reversed and is not linked to any other identifier falls on the anonymous side of that line, which is why cookieless tools can operate without a consent banner while cookie-based trackers cannot.
France's CNIL has gone further and published explicit technical criteria for when audience-measurement tracking is exempt from consent: it must serve only the publisher's own measurement, IP addresses must be anonymised, no cross-site or cross-app tracking may occur, and any identifier the tool does set cannot outlive 13 months. Cookieless hashing satisfies the strictest version of that bar by not setting a persistent identifier at all. For the practical difference this makes to your actual numbers, see how to track visitors without a cookie banner; for what to do with the conversions this enables, see tracking conversions without cookies.
The accuracy trade-off, stated plainly
Cookieless analytics will never hand you an exact lifetime count of one specific person the way an ad network's logged-in tracking can. What it gives up in individual precision, it gains back in coverage: every visitor is counted, including the share who would otherwise reject a cookie banner or load with a tracker-blocking browser extension. For a small business watching traffic sources, page performance, and conversions, that complete, anonymous count is usually the more useful number, not the less accurate one.