Cookieless tracking means measuring behaviour without relying on third-party cookies, and increasingly without relying on browser-stored identifiers at all. It isn't one technique. It's five, and they solve different halves of the problem.
The short version: server-side tagging plus Consent Mode v2 with modeling is the practical baseline for most EU businesses in 2026. Everything else on this list is either a supplement to that, or a specialised answer to a specific gap.
Here is the part vendors won't tell you: none of these recover the data you lost. They reduce the loss. A user who denies consent stays denied, and no architecture changes that. Anyone selling you 100% recovery is either misunderstanding the law or ignoring it, and in the EU that distinction eventually becomes expensive.
This article covers the five methods that work, what each one actually fixes, what it costs, and where each one breaks.
- Third-party cookies are effectively gone. The bigger problem in 2026 is that first-party cookies are being shortened too: Safari's ITP caps script-set cookies at 7 days, or 24 hours in some cases.
- Server-side tagging moves the cookie to your own domain, which restores duration. It doesn't bypass consent and must not be used to.
- Consent Mode v2 with modeling recovers a portion of denied-consent conversions statistically. It needs traffic volume to work.
- First-party data (logins, emails, CRM) is the only identifier that survives everything, because the user handed it to you.
- Fingerprinting is technically effective, illegal for most EU purposes without consent, and not worth the risk.
What actually broke, and why cookieless tracking exists
Two separate things happened, and people usually only notice the first.
Third-party cookies died. Cross-site tracking is over. Retargeting pools shrank, view-through attribution collapsed, and audience matching got worse. This is the change everyone talks about.
First-party cookies got shortened. This is the one that quietly hurts more.
Safari's Intelligent Tracking Prevention caps cookies set by JavaScript at 7 days, and in some circumstances 24 hours. Firefox does something similar. Your GA4 client ID lives in a first-party cookie set by JavaScript, so on Safari your returning visitor after nine days is a brand new user.
The result: inflated user counts, broken return-visit measurement, and attribution windows that silently truncate. A 30-day consideration cycle can't be measured with a 7-day identifier, and most businesses never notice the mismatch.
Not sure what your current setup actually loses? The Free GTM Audit checks how your tags handle consent and where the gaps are. Enter a URL, get a report in about 10 minutes. No signup.
Method 1: Server-side tagging
What it fixes: cookie duration, ad blocker loss, and data control.
You run a tagging server on your own subdomain (analytics.yoursite.com). The browser sends events there, and the server forwards them to GA4, Meta, Google Ads, and anywhere else. Because the cookie is now set by your server via HTTP header rather than by JavaScript, ITP's 7-day cap doesn't apply. You get back a normal cookie lifetime.
It also means ad blockers, which mostly work by blocking requests to known third-party domains, no longer see a request to google-analytics.com. They see a request to your own domain.
What it costs: roughly €50-200/month in cloud hosting for a mid-size site, plus implementation. It isn't a weekend project, and getting it wrong is worse than not doing it.
What it doesn't fix: consent. This is the important part, and the part that gets abused. Server-side tagging doesn't make consent optional. If a user denies analytics storage, you still can't set an analytics cookie, and moving the code to your server changes nothing about that legally. Using server-side tagging to route around a consent denial is a straightforward GDPR violation dressed up as an architecture decision.
I have audited setups where an agency implemented server-side specifically so the client "wouldn't have to worry about the cookie banner anymore." That isn't a technical solution. That's a liability with a monthly hosting bill. If you want the mechanics, start with the server-side GTM guide.
Method 2: Consent Mode v2 with modeling
What it fixes: the measurement gap created by consent denial.
When a user denies consent, Google's tags don't stop. They send a cookieless ping: no identifiers, no storage, just the signal that something happened. Google then uses the behaviour of consenting users to statistically model what the non-consenting ones probably did.
You get modeled conversions back. Not real ones, modeled ones, and Google is upfront that they are estimates.
What it costs: nothing beyond correct implementation.
What it requires: volume. Modeling needs enough consenting traffic to learn from. Below roughly 1,000 daily events and a few hundred monthly conversions, Google won't model at all, and you get nothing back. Small sites are structurally excluded from this recovery, which nobody mentions when recommending it.
The mistake I find most often: Advanced mode configured perfectly in GTM, and modeling never switched on in the GA4 property. All the plumbing, none of the water. The two halves live in different products and people configure one. See the Consent Mode v2 guide for the full signal chain.
Method 3: First-party data
What it fixes: identity. Permanently.
If a user logs in, subscribes, or buys, you have an email address. Hash it, and you have an identifier that survives every browser change, every ITP update, and every cookie deprecation, because it doesn't live in the browser at all.
This is what powers GA4 User-ID, enhanced conversions in Google Ads, and the Meta Conversions API. It's the only method on this list that gets better over time rather than degrading.
What it costs: product work, not tracking work. You need a reason for people to identify themselves, and that reason has to be worth more to them than their anonymity.
Where it breaks: it only covers identified users. For a media site where 98% of readers never log in, first-party data solves almost nothing about your traffic analytics. For an e-commerce store where every buyer gives you an email at checkout, it solves nearly everything about your conversion measurement.
Know which one you are before you invest here.
Method 4: Aggregated and modeled measurement
What it fixes: strategic questions, not individual journeys.
If you can't follow a person, measure the aggregate instead. Marketing mix modeling correlates spend against outcomes at the channel level and needs no user-level data at all. Incrementality tests turn a channel off in one region and compare against a control.
This sounds like a step backwards. It's actually the only method here that never lies to you, because it doesn't depend on tracking at all. If you switch off a channel and revenue drops more than that channel was credited with, it was creating demand your attribution model was assigning elsewhere.
What it costs: analytical time, and enough spend to make the maths meaningful.
Where it breaks: it can't tell you which button to move on a landing page. Wrong tool for optimisation, right tool for budget allocation.
Method 5: Fingerprinting, and why you should not
What it does: builds a probabilistic identifier from browser characteristics, screen size, fonts, timezone, GPU, and dozens of other signals. It's effective, persistent, and requires no cookie.
Why you should not use it in the EU: it's storage-and-access under ePrivacy, and it's personal data processing under GDPR. It requires consent, exactly like a cookie does, and it's specifically worse because the user can't see it, can't clear it, and can't opt out of it. Regulators have been clear about this, and "the vendor said it was cookieless so it was fine" has never once worked as a defence.
Some vendors market fingerprinting as "cookieless analytics" and technically that's accurate. It's also the reason to read what a tool actually does before you buy it, rather than the category it files itself under.
If a tool promises you full measurement with no consent required, it's doing one of two things: fingerprinting, or lying. Both are worth walking away from.
Your cookieless tracking roadmap, in order
For most EU businesses, in this sequence:
- Fix consent first. A better banner with clearer copy raises consent rates more than any architecture change. Every percentage point of consent is data you get for free, permanently.
- Turn on Consent Mode v2 Advanced, and verify modeling is actually enabled in GA4. Free, and the single most common thing I find half-implemented.
- Collect first-party data wherever the exchange is honest. Logins, newsletters, accounts. Not dark patterns.
- Then consider server-side tagging. It's the biggest technical lift and it pays off most when the first three are already right. Doing it first is a common and expensive ordering mistake.
- Use aggregate measurement for budget decisions. Stop trying to make user-level tracking answer questions it structurally can't.
Notice that the cheapest interventions come first and the expensive one comes fourth. That ordering is deliberate, and it's the opposite of how most agencies pitch this work.
Frequently asked questions
What is cookieless tracking? Cookieless tracking means measuring user behaviour without relying on third-party cookies, and often without browser-stored identifiers at all. In practice it combines server-side tagging, Consent Mode modeling, first-party data, and aggregate measurement.
Does cookieless tracking mean I don't need a cookie banner? No. Consent under EU law is about storing or accessing information on a device and processing personal data, not about the word "cookie." Server-side tagging, fingerprinting, and local storage all still require consent. Any vendor telling you otherwise is selling you a compliance problem.
Does server-side tagging bypass consent requirements? No, and using it that way is a GDPR violation. Server-side tagging fixes cookie duration and ad blocker loss. It doesn't change what you're legally allowed to do when a user says no.
Will I recover all my lost data with cookieless tracking? No. These methods reduce loss, they don't eliminate it. A user who denies consent stays denied. Consent Mode modeling returns statistical estimates for some of the gap, and only if you have enough traffic volume for the model to work.
Is fingerprinting legal in the EU? Not without consent. Fingerprinting falls under ePrivacy storage-and-access rules and GDPR personal data processing. Marketing it as "cookieless" doesn't exempt it, and regulators have addressed this directly.
What is the cheapest thing I can do first? Improve your consent rate. A clearer banner costs nothing architecturally and every additional consent is permanent, unmodeled, fully accurate data. Most businesses skip straight to expensive infrastructure and leave this on the table.
Next steps
Cookieless tracking isn't a product you buy. It's a sequence of decisions, and the order matters more than the tools.
Start by finding out what you're actually losing. Check your consent denial rate, then check whether Consent Mode modeling is genuinely switched on in GA4, not just configured in GTM. That single check resolves a surprising number of "our data is broken" conversations, and it costs nothing.
Then be honest about which method matches your business. A logged-in SaaS product and an anonymous media site have completely different cookieless problems, and copying each other's solutions wastes money in both directions.
And treat anyone promising full measurement without consent as a red flag rather than a supplier. In the EU, that promise is either fingerprinting or fiction.
If you want your current setup checked properly, the Free GTM Audit inspects how your tags handle consent. And if you want the whole thing implemented or independently verified every month, that's what the GTM and GA4 monitoring retainer is for. €150/month for GTM, €250/month for GTM plus GA4. Server-side implementation is scoped separately at €80/hour. Full pricing here.
Sources and further reading
- Intelligent Tracking Prevention and cookie lifetimes (WebKit)
- Consent Mode and behavioural modeling (Google)
- EDPB guidelines on technical scope of ePrivacy Article 5(3) (EDPB)
Is your GA4 attribution telling the truth?
The Free GTM Audit inspects the tracking layer that feeds your channel data: broken tags, consent gaps, and firing order. Enter a URL, get a report in about 10 minutes. No signup.
Start Free GTM Audit