Cookieless Analytics: Measure Everything, Ban Nothing

By default, Datalenk stores and reads nothing on the visitor's device. No cookies, no localStorage. That single default removes the consent-banner trigger for your analytics, keeps the 50 to 60% of visitors who refuse consent in your numbers, and shrinks your GDPR surface to a paragraph in your privacy policy instead of a compliance project.

Tracking depth is a layer you choose, not a default we hide

Most "cookieless" tools quietly store an identifier anyway. We made the layers explicit, and the shallow one is the default.

• Cookieless (default, always on): nothing written to the device. Visits are stitched server-side within the day, with a salted hash that rotates every 24 hours, so nobody, including us, can follow a person from one day to the next. You get traffic, sources, channels including AI assistants, in-session funnels and revenue by channel. No banner needed, anywhere.
• Persistent (opt-in, per site): stores a pseudonymous random ID (localStorage plus a first-party 90-day cookie your own backend can read). It unlocks returning visitors, multi-day attribution and multi-session journeys. Turning it on takes a checkbox in your settings where we spell out the legal implications, because at that point you do owe your visitors a line in your privacy policy, and a banner where your jurisdiction requires one.
• Identity (your call, in your code): one datalenk.identify(email) at login welds a person to their acquisition channel for life, across devices. Nothing is stored on the device, and the email is HMAC-hashed server-side with a secret pepper. We never keep it in clear text.

What it does

• No cookie banner needed for analytics on the default layer: nothing on the device means no ePrivacy consent trigger for measurement.
• No consent-refusal data hole: you keep the visitors that banner-dependent tools lose the moment someone clicks "reject".
• Do Not Track honored: if the browser sends the signal, the tracker disables itself entirely. Nothing is collected, nothing is stored.
• EU-hosted: your visitors' data lives on servers in Germany (Hetzner), on our own ClickHouse and Postgres. No US entity touches it.
• Ad-block resilient, if you want it: point a CNAME at us and the script and the events travel through your own subdomain.
• No raw IPs, ever: an IP is used in-memory to derive a coarse location, then discarded.

The honest legal line

We say "GDPR-friendly by design", never "100% compliant, guaranteed", because cookie law is interpreted differently across member states and vendor marketing is not case law. What a genuinely cookieless, EU-hosted tool gives you is a strong, documented, good-faith position and the smallest possible exposure, not magic immunity.

We hold ourselves to the same standard: datalenk.com runs on the Persistent layer, because we want multi-day attribution on our own funnel, and we say so in our own privacy policy. We are not going to sell you an absolute we do not respect ourselves.

Why this matters now

Platforms keep making measurement depend on their goodwill, and EU-US data transfers have been invalidated twice with a third challenge pending. A tool whose default collects nothing on the device, on EU infrastructure, is indifferent to how that litigation ends. That is the durable position, and it is the one you get out of the box.

Go deeper

What GDPR actually requires from analytics: ↗. The EU-hosted landscape and where Datalenk sits: ↗. Why the Schrems litigation matters: ↗.

Measure 100% of your visitors, banner-free. Cookieless by default, EU-hosted. 14-day trial, card required. Start your trial.

FAQ

Does cookieless analytics really need no banner? On the default layer, where the tool stores and reads nothing on the device, the ePrivacy consent trigger for analytics does not apply. Turn on the Persistent layer and that changes: it writes an identifier, so you inform your visitors. We make you tick a box that says so before it turns on.

Where is my data hosted? On EU infrastructure, in Germany. We run our own ClickHouse and Postgres, no managed US service in the path of your visitors' data.

How accurate are unique visitors without cookies? Very close for practical purposes, within the day. A salted daily hash estimates uniqueness with a small trade-off at the edges. Across days, a visitor who returns counts as new, which is exactly what "we do not follow people over time" means. If you need the returning-visitor number, that is what the Persistent layer is for, and we would rather you make that choice knowingly.