Privacy by design: how Vivestats measures without cookies
Most web analytics depend on cookies and a banner. Here’s how we do it differently.
Traditional web analytics has a double problem: it needs cookies to work and it needs a banner to ask for permission. That leaves you with two bad options — break the user experience or break the law.
At Vivestats we decided both options were wrong. Here’s how we solved it.
The trick: ephemeral hashes
Instead of saving a cookie with an identifier, we compute a hash from:
- Truncated IP (the last octets are discarded)
- User-Agent
- Current day (changes every 24 h)
The hash is enough to detect a “unique visit” in a session, but it cannot be used to identify anyone the next day. It’s like a fingerprint that wipes itself.
What we don’t store
- Full IP addresses.
- Persistent identifiers.
- Cross-site tracking.
- Aggressive fingerprinting (canvas, fonts, etc.).
- Form data or sensitive fields.
What we do store
- Visited URL and referrer.
- Country (country-level, not city) derived from IP.
- Device type (mobile / desktop / tablet).
- Generic browser (Chrome, Safari, Firefox, etc.).
- Visit timestamp.
That aggregated information is more than enough to answer “where is my traffic coming from?” without compromising anyone.
Compliant by default
Because we don’t use cookies or personal data, Vivestats is compliant with:
- GDPR (European Union).
- CCPA (California).
- LGPD (Brazil).
- Law 1581 (Colombia).
No DPIA, no banner, no lawyer. You just paste the snippet and you’re done.
The snippet
<script defer src="https://cdn.vivestats.com/script.js" data-site-id="YOUR_SITE"></script>3 KB. Async. No document.write. Your page loads, your Web Vitals don’t suffer, and tomorrow you have data in the dashboard.
If you’re into the technical details, we publish the internal paper in the docs. And if you find a way to break Vivestats’ privacy, we’ll pay you a bounty.