Tracking modes and cookieless
How auto, full and cookieless modes differ, who decides which applies, and what each one stores in the browser.
Every visit is measured in one of two modes. The site setting under Site settings › Tracking decides which, and Auto decides per visitor.
The modes
| Mode | Identifier | Good for |
|---|---|---|
| Cookieless (lightweight) | Nothing is stored in the browser. Visits are grouped on the server with a key made from a daily secret, the site, the IP address and the browser. | Visitor counts, sources, pages and funnels within a day. |
| Full | A first-party cookie, statsy_vid, holding a random id for up to a year, plus a session id in the tab’s session storage. | Returning visitors, journeys across days, revenue attribution and replays. |
| Auto (default) | Cookieless for visitors in the EU, EEA, UK and Switzerland, for browsers sending Global Privacy Control, and when the country is unknown. Full for everyone else. | Balancing privacy rules against measurement. |
The daily secret is deleted after two days, so a cookieless key cannot be linked back to an IP address, or across days, after that. A session ends after 30 minutes of inactivity.
Who decides
In the browser, the first of these that applies wins:
- A consent choice passed with
statsy.consent()and remembered in local storage. - The
data-modeattribute on the tag. - The mode the server picks for this site and this visitor.
The server never upgrades a visitor: if the site is set to Cookieless, every visit is cookieless. If the site is set to Auto, a visitor sending Global Privacy Control, or one whose country cannot be determined, is cookieless.
Do Not Track and Global Privacy Control
By default the script sends nothing at all when the browser sets Do Not Track or Global Privacy Control. You can switch that off with data-ignore-dnt="true", and Global Privacy Control then still forces cookieless mode under Auto.
Consent banners
Cookieless mode avoids cookies and persistent identifiers, which in many cases removes the need for an analytics consent banner. Rules differ by country and by configuration, and you remain responsible for your own notices and consent. If you already run a banner, wire it to statsy.consent() and visitors who accept are measured in full mode.
banner.on('accept', () => statsy.consent('granted'));
banner.on('reject', () => statsy.consent('denied'));What full mode unlocks
- Returning visitors, and journeys that span more than one day.
- Revenue attribution, because a payment has to be matched back to a visitor.
- Session replays, which are only recorded for full-mode visitors.
- The visitor id appended to hosted checkout links, which is how a Stripe or Lemon Squeezy payment finds its way back to a visit.
Last updated · Markdown version