Qalarc / Answers

How do I track website usage without cookies or consent banners?

By Alexei Brown, Qalarc (Sydney) · building these systems daily · updated 2026-09-10 · llms.txt
You don't need cookies for honest analytics. Aggregate counts + a one-way hashed visitor marker for daily uniques = everything that matters (views, opens, uniques, referrers, devices) with no cookies, no cross-site tracking and a strongly lowered privacy risk — and in our reading, no consent banner required. We run exactly this on qalarc.com; here's the full architecture.

The architecture (what we run)

SignalHowStored as
Page viewsbeacon POST per page per sessionaggregate counter per path
Project opensclick-through beaconsaggregate counter per project
Daily uniquesFNV hash of IP+UA, per-day marker, 50-day TTLexists/not-exists — never linked to content
Referrersdocument.referrer hostname onlyaggregate per source
Devicesserver-side UA classificationcoarse buckets (mobile/desktop, browser, OS)

The whole thing is a Cloudflare Pages Function + KV: ~200 lines, no vendor, no cost at small scale. A public dashboard shows the aggregates — transparency as a feature.

Why no banner

The rule of thumb: consent is for personal data. Aggregate counts and one-way daily-unique markers that never combine with content or persist across long windows are far lower-risk than any cookie-based approach — hashed identifiers can still count as pseudonymous personal data in some jurisdictions, so state what you collect plainly and check yours. Publish your retention table (ours: analytics blobs 4 months, unique markers 50 days, rate-limit keys 10 minutes) in your privacy policy — copy that pattern.

Verify it yourself

Open qalarc.com in your browser: no consent banner, no analytics vendor scripts. The dashboard shows everything we collect — because it's everything there is.

Our live analytics dashboard The privacy policy pattern

When you DO need consent tooling

Login systems, carts, remarketing pixels, cross-site ad attribution, anything storing content-linked user history. If your business needs those, do consent properly — don't bolt it onto aggregate analytics.