Cookieless Tracking Mode

Cookieless mode runs Zenovay analytics without storing anything in the visitor's browser: no cookies and no localStorage. It is the pre-selected choice when you add a website.

What is cookieless mode?

Cookieless mode is a per-website setting that prevents the tracking script from writing any cookies or localStorage on the visitor's device. Instead, the server derives an anonymous ID from a hash of the IP subnet, the user agent and a salt that rotates every day. The raw IP address is not stored. A visit still spans several pages (it ends after 30 minutes without activity), but the ID changes every day, so a returning visitor is not linked across days.

Cookieless mode is the pre-selected choice when you add a website, so unless you picked the first-party cookie mode at that moment, the script writes nothing to the browser. Websites created before cookieless became the pre-selected choice keep whatever mode they were set up with, so check the setting on an older site rather than assuming. You can switch either way at any time. Using a visitor cookie gives more accurate returning-visitor counts in exchange for storing an identifier on the device.

There is also a middle way: with data-cookieless="until-consent", the tracker starts cookieless and switches to its first-party cookie only after the visitor accepts your cookie banner. See Cookieless until consent below.

This is the strictest client-side storage setting Zenovay offers. It is about storage, not about what gets recorded: session replay, heatmaps, screenshots, error tracking, frustration detection, live cursor, B2B company identification, and value scoring all keep running in cookieless mode. Switch those off individually in the website's settings if you do not want them.

One thing is still written on sites that use the exit-intent widgets: a __zv_widget_shown_session marker in sessionStorage, so the same visitor is not shown the same popup twice in one session. It is written regardless of cookieless mode and is cleared when the tab closes. If you need a site that writes literally nothing, leave the widgets switched off.

Trade-off: because nothing is stored in the browser, a visitor who comes back on another day gets a new anonymous ID and is counted as a new visitor. Funnels with a 7-day or 30-day time window count fewer finishers for the same reason.

Checking or enabling cookieless mode

Cookieless mode is controlled per website, from that website's settings. New websites already have it on; these steps let you confirm it or turn it on for an existing site.

1. 1

   Open your website's settings

   Go to Domains, open the website you want to configure, then open its Settings and select the Advanced tab.

2. 2

   Toggle cookieless mode on

   In the Privacy & Cookies section, find Cookieless Mode and switch it on.

3. 3

   Copy the updated snippet

   Zenovay automatically adds data-cookieless="true" to your install snippet. Replace your existing snippet on the site with the updated one (see below).

Script tag

With cookieless mode on, your install snippet carries the data-cookieless attribute:

<script
  defer
  data-tracking-code="YOUR_TRACKING_CODE"
  data-cookieless="true"
  src="https://api.zenovay.com/z.js"
></script>

An explicit data-cookieless attribute on the script tag always wins over the dashboard setting. The dashboard follows what is really installed: if your installed script forces cookieless mode, the website's cookieless setting is switched on automatically, so the dashboard always shows the mode that is actually active. To move a site back to cookies, remove data-cookieless="true" from the snippet on your site as well as switching the setting off.

Note: Zenovay respects Do Not Track (DNT) and Global Privacy Control (GPC) by default, with one exception: bundles served through the first-party proxy ignore DNT automatically. GPC is always honored and cannot be overridden. See Respecting Do Not Track and Global Privacy Control below.

What changes in cookieless mode

Behavior	Cookieless off	Cookieless on (default)
Page view tracking	Yes	Yes
Event tracking	Yes	Yes
Cookies / localStorage written	Two first-party cookies, zenovay_visitor_id (30 days by default) and zenovay_session_id (until the visit ends), plus a few localStorage keys	None, apart from the exit-intent widget marker described above
Visitor identifier	First-party cookie, kept across days	Anonymous ID derived on the server, changes every day
Pages of one visit linked	Yes	Yes
Returning visitor detection	Yes, across days	Only within the same day

Page views, events, traffic sources, device and browser data, and country-level geography are all still collected, and the pages of one visit stay linked. The main thing you give up is recognising returning visitors across days, because there is no browser-side identifier to tie visits on different days together.

When to use cookieless mode

A good fit for

• Sites that want to avoid browser storage entirely
• Privacy-sensitive industries (healthcare, legal, government)
• Teams that prefer the strictest possible client-side footprint

Less ideal for

• Sites that depend heavily on accurate returning-visitor counts
• Funnels with a 7-day or 30-day time window, which count fewer finishers when visitors come back on another day

If you are unsure, you can turn cookieless mode on, watch your returning-visitor numbers for a week, and turn it back off if the trade-off isn't worth it for your site. If you show a cookie banner anyway, Cookieless until consent below gives you both.

Respecting Do Not Track and Global Privacy Control

Zenovay honors both Do Not Track (DNT) and Global Privacy Control (GPC) in the tracking script, independent of cookieless mode. The two are not treated the same way.

• GPC (navigator.globalPrivacyControl === true): the tracker stops before it sends anything. This check cannot be overridden, by attribute or by setting.
• DNT (navigator.doNotTrack === "1" or window.doNotTrack === "1"): the tracker stops before it sends anything, unless the DNT check has been switched off for that page.

Both checks run in the browser. Nothing on the server reads a DNT request header, so a request that reaches the ingestion API without running the script is not filtered by DNT.

Switching the DNT check off

data-ignore-dnt="true" switches off the DNT check only. It has no effect on GPC.

<script
  defer
  data-tracking-code="YOUR_TRACKING_CODE"
  data-ignore-dnt="true"
  src="https://api.zenovay.com/z.js"
></script>

Whether ignoring DNT is acceptable for your site depends on your jurisdiction and on what your privacy policy says.

Cookieless until consent

If you show a cookie banner and want returning visitors recognised across days once they agree, with no cookies before that, load the script in consent mode:

<script
  defer
  data-tracking-code="YOUR_TRACKING_CODE"
  data-cookieless="until-consent"
  src="https://api.zenovay.com/z.js"
></script>

• The tracker starts cookieless: no cookies, no localStorage, and the server's anonymous daily ID.
• When the visitor accepts your banner, call zenovay('consent', 'granted'). Zenovay switches to its first-party cookie and keeps the IDs of the ongoing visit, so the visit is not split in two.
• When the visitor declines, or withdraws consent later, call zenovay('consent', 'denied'). Zenovay removes its cookies and storage and continues cookieless.
• On later pages, the tracker starts in cookie mode if the visitor consented before.

// The visitor accepted in your banner
window.zenovay && window.zenovay('consent', 'granted');

// The visitor declined, or withdrew consent later
window.zenovay && window.zenovay('consent', 'denied');

The same call also gates session replay and heatmaps. For those, call it again with the stored decision on every page load. See the consent documentation for details.

Loading tracking only after consent

If you use a consent banner and only want to load analytics after the visitor agrees, load the script conditionally:

// Only load tracking after consent is granted
function handleConsent(granted) {
  if (granted) {
    const script = document.createElement('script');
    script.defer = true;
    script.src = 'https://api.zenovay.com/z.js';
    script.setAttribute('data-tracking-code', 'YOUR_TRACKING_CODE');
    document.head.appendChild(script);
  }
}

You can combine this with cookieless mode by also setting data-cookieless="true" on the injected script.

Legal context

Cookieless mode reduces what Zenovay writes to a visitor's device, which can simplify your compliance posture:

• ePrivacy / cookie rules: rules that hinge on storing or reading information on a device have less surface area when no cookies or localStorage are written.
• GDPR / CCPA: less persistent identification on the device means a smaller data footprint.

Cookieless mode is a technical control, not legal advice. Whether you still need a consent banner depends on your jurisdiction, the rest of your stack, and how you use the data. Review your setup with your own legal or privacy advisor, and describe your analytics accurately in your privacy policy.

Troubleshooting

Returning visitors look lower than before

This is expected in cookieless mode. With no browser-side identifier, visits on different days are not linked, so unique-visitor counts trend higher and returning-visitor counts trend lower. It's a trade-off, not a bug.

Cookieless mode switches itself back on

Your installed script carries data-cookieless="true". The attribute on the script tag always wins, and the dashboard follows what is really installed. Remove the attribute from the snippet on your site, then switch the setting off.

Verify DNT / GPC in the browser

You can check the signals the visitor's browser is sending from the console:

console.log('DNT:', navigator.doNotTrack);
console.log('GPC:', navigator.globalPrivacyControl);

If GPC is set, the tracker will not record that visit. If DNT is set, the tracker will not record it either, unless you added data-ignore-dnt="true" or you load the script through the first-party proxy, which applies that override for you.

Next steps

• GDPR Overview
• Cookie Consent
• Data Collection Practices