Why cookieless analytics is enough for SaaS

Cookieless analytics is enough for most SaaS products because the moment that matters for revenue, signup, is also the moment you can identify the person with your own user id. Cookies mainly help you recognise anonymous visitors across days, and for a SaaS that gap is small, measurable, and cheaper than a consent banner.

What a cookie actually buys

An analytics cookie stores a random id in the visitor’s browser. On every later visit, the tool reads it back and knows it is the same browser. That buys three things:

1. Returning anonymous visitors. Someone who reads your blog on Monday and comes back on Thursday is one visitor, not two.
2. Multi-day anonymous journeys. A funnel from first visit to signup that spans a week can be followed before the person tells you who they are.
3. Long first-touch windows. The channel that first brought someone weeks ago is still known when they sign up.

It costs you a consent banner in the EU and UK, and with it every visitor who clicks “reject” or ignores the banner. It also costs a script that privacy-focused browsers and blockers treat with suspicion.

How cookieless counting works

ProductLense counts a visitor with a hash:

visitor_id = sha256(site_id | ip | user_agent | daily_salt), first 16 hex characters

The salt is derived from a server secret and the date, and changes every 24 hours. The IP address is used for the hash and a country lookup and then discarded. Nothing is written to the browser: no cookie, no local storage.

The same browser on the same day produces the same id, so sessions, bounce rate, same-day journeys and first touch for same-day signups all work. The same browser tomorrow produces a different id that cannot be linked back, because yesterday’s salt is gone.

What you lose

Being plain about the trade:

• Returning anonymous visitors are counted again on each new day. Unique visitor counts over a month are higher than a cookie-based tool would report for the same traffic.
• Anonymous journeys longer than a day break. If someone reads a comparison post on Monday, comes back from a Google search on Wednesday and signs up, the first touch ProductLense records for the signup visitor is Wednesday’s search, not Monday’s post.
• Long consideration cycles are harder to read. If your product is bought after weeks of anonymous research, a cookie captures more of that path.

Why it is enough for SaaS

Three reasons.

Signup is the identity moment. A SaaS gets a user id at signup. From then on, identify links every visit and every payment to that user, across days and devices, without cookies. The part of the journey that decides revenue attribution, from signup to first payment to renewals and refunds, is fully joined.

Most signups happen early. For self-serve SaaS, a large share of signups happen in the visitor’s first session or first day, and that is fully covered. You can check this for your own product: ProductLense’s visitor journeys show how many signups had earlier visits on the same day.

Complete counts beat long memory. With a banner, the visitors who decline are simply missing, and they are not a random sample. A cookieless tool counts everyone, every day. For comparing channels, complete counts with a one-day memory are usually more accurate than a long memory over a filtered sample.

What you gain

• No consent banner in most setups, because nothing is stored on the device and no IP is kept. Whether your site needs a banner still depends on your other scripts, such as ad pixels or chat widgets.
• A 1 KB script with a CI-enforced budget, loaded with defer, so it does not slow down pages.
• Less personal data to hold. No IPs, day-scoped pseudonymous ids, raw events deleted after 90 days. Personal data appears only when you choose to send a user id or email with identify.
• Friendlier to privacy browsers. There is no third-party cookie to block, so data from privacy-conscious visitors is less likely to be missing.

Cookieless is not “no personal data”

Under GDPR, an IP address is personal data even if you only hold it for milliseconds, and a hashed id can still count as pseudonymous data. Cookieless analytics reduces what is processed and stored, but it is still processing. That is why ProductLense acts as a processor under a DPA, lists its subprocessors on request, keeps data in Germany, and documents every field in the privacy docs. The same applies under India’s DPDP Act, where your company is the data fiduciary and ProductLense is your processor.

How to get the most from it

1. Call identify at signup and login, with the same user id you store on your billing provider’s customers as pl_user_id.
2. Tag every link you control with UTM parameters, so a newsletter click is not counted as direct traffic.
3. Look at the Sources table by first-touch channel with revenue and profit, not just visitors.
4. If your product has long anonymous research cycles, compare signup counts by day-of-first-visit in visitor journeys, and decide with your own data whether the one-day window loses anything you care about.

For a typical SaaS, it does not. Read how ProductLense attributes revenue or install the script and check with your own traffic.