Short answer: not in cookieless mode. Cookieless mode is the pre-selected choice when you add a website, so unless someone chose the first-party cookie mode at that moment, your tracker sets no cookies. Older websites keep whatever mode they were set up with, so check the setting rather than assuming. In cookieless mode the tracker sets no first- or third-party cookies and does not write to localStorage or IndexedDB.
One sessionStorage entry is the exception: sites using Zenovay's exit-intent widgets get a __zv_widget_shown_session marker so the same popup is not shown twice in a session. It is written in cookieless mode too, and it is gone when the tab closes.
What we use instead
In cookieless mode, nothing that identifies the visitor is stored in the browser. The server derives an anonymous visitor ID from a one-way hash of the IP subnet, the user agent and a salt that rotates every day. Your analytics tables hold that ID, not the IP address.
The result:
- No persistent identifier on the device
- No cross-site tracking
- The page views of one visit are still linked (a visit ends after 30 minutes without activity)
- The visitor ID changes every day, so it does not link the same person across days
Two details worth knowing. The raw address is still used at request time for geolocation, rate limiting, and abuse detection before it is hashed, and it exists in bounded form in a few operational places: IP Address Handling lists all of them. And B2B company identification uses a separate, deliberately stable hash so that visits from the same company network can be correlated over time.
What that means for compliance
ePrivacy Article 5(3), and its national versions such as TDDDG §25 in Germany and FMG Art. 45c in Switzerland, turns on whether something is stored on or read from the visitor's device. In cookieless mode the tracker does not do that, apart from the widget marker described above.
GDPR still applies to the server-side processing, because a hashed identifier is pseudonymous personal data, so your privacy policy should disclose that you use Zenovay and on what basis. What that means for your own banner depends on your jurisdiction and on what else your site loads. See Do I need a cookie consent banner?.
When does Zenovay set cookies?
- In cookie mode, the tracker sets two first-party cookies on your site:
zenovay_visitor_id(30 days by default, configurable) recognises a returning visitor across days, andzenovay_session_idkeeps the pages of one visit together until the visit ends. - With
data-cookieless="until-consent", the tracker sets those cookies only after your banner callszenovay('consent', 'granted').zenovay('consent', 'denied')removes them again. See Cookies only after consent below. - On
app.zenovay.comitself, cookies keep you signed in to your own dashboard. Those cookies never appear on your visitors' browsers.
Can I switch back to cookies?
Cookieless mode is a per-website setting. Open your website's dashboard, go to Settings → Advanced, and find the Privacy & Cookies section. Turning the Cookieless Mode toggle off lets the tracker set a visitor cookie, which can measure long-window unique visitors with higher accuracy. You can choose the Visitor Cookie Lifetime there too (30 days by default, up to 1 year). Switching to cookies puts a stored identifier on the visitor's device, which is exactly what consent rules are written around, so review your banner setup at the same time.
An explicit data-cookieless attribute on your script tag always wins over this setting. If your installed snippet contains data-cookieless="true", remove it as well, otherwise the dashboard switches the setting back on to show the mode that is actually active.
Switching does not backfill. Cross-day visitor identity only builds forward from the moment you turn the cookie on, so expect returning-visitor numbers to climb over the following days rather than jump.
Cookies only after consent
If you show a cookie banner, you can have both: no cookies before consent, and returning visitors recognised across days after it. Add data-cookieless="until-consent" to your script tag:
<script
defer
data-tracking-code="YOUR_TRACKING_CODE"
data-cookieless="until-consent"
src="https://api.zenovay.com/z.js"
></script>
The tracker starts cookieless. When the visitor accepts your banner, call zenovay('consent', 'granted'): Zenovay switches to its first-party cookie and keeps the ongoing visit, so it is not split in two. When the visitor declines or later withdraws consent, call zenovay('consent', 'denied'): Zenovay removes its cookies and storage and continues cookieless. See Cookie consent and banners for a full example.