Cookieless Tracking Mode

Zenovay does not use cookies for its core analytics out of the box. Cookieless mode goes one step further: it stops the tracking script from storing an identifier in the visitor's browser at all.

What is cookieless mode?

Zenovay is already cookieless server-side. Cookieless mode is a per-website setting that prevents the tracking script from writing any cookies or localStorage on the visitor's device. In this mode the script uses in-memory identifiers that exist only for the current page and disappear when the page unloads.

Cookieless mode is the pre-selected choice when you add a website, so unless you picked the first-party cookie mode at that moment, the script writes nothing to the browser. Websites created before cookieless became the pre-selected choice keep whatever mode they were set up with, so check the setting on an older site rather than assuming. You can switch either way at any time. Using a visitor cookie gives more accurate returning-visitor counts in exchange for storing an identifier on the device.

This is the strictest client-side storage setting Zenovay offers. It is about storage, not about what gets recorded: session replay, heatmaps, screenshots, error tracking, frustration detection, live cursor, B2B company identification, and value scoring all keep running in cookieless mode. Switch those off individually in the website's settings if you do not want them.

One thing is still written on sites that use the exit-intent widgets: a __zv_widget_shown_session marker in sessionStorage, so the same visitor is not shown the same popup twice in one session. It is written regardless of cookieless mode and is cleared when the tab closes. If you need a site that writes literally nothing, leave the widgets switched off.

Trade-off: because nothing is stored in the browser, returning-visitor recognition drops (roughly 10-15%). The same person visiting twice is more likely to be counted as two new visitors.

Checking or enabling cookieless mode

Cookieless mode is controlled per website, from that website's settings. New websites already have it on; these steps let you confirm it or turn it on for an existing site.

1. 1

   Open your website's settings

   Go to Domains, open the website you want to configure, then open its Settings and select the Advanced tab.

2. 2

   Toggle cookieless mode on

   Find Zero Client-Side Storage Mode and switch it on.

3. 3

   Copy the updated snippet

   Zenovay automatically adds data-cookieless="true" to your install snippet. Replace your existing snippet on the site with the updated one (see below).

Script tag

With cookieless mode on, your install snippet carries the data-cookieless attribute:

<script
  defer
  data-tracking-code="YOUR_TRACKING_CODE"
  data-cookieless="true"
  src="https://api.zenovay.com/z.js"
></script>

The on/off switch for cookieless mode is the per-website setting above, which the script reads on every load. The data-cookieless="true" attribute applies that setting immediately on the very first hit, before the script has fetched your settings, so no storage is written even briefly. If the website setting is on but the attribute is missing, the script still runs cookieless once settings load; adding the attribute just makes it enforce from the first request.

Note: Zenovay respects Do Not Track (DNT) and Global Privacy Control (GPC) by default, with one exception: bundles served through the first-party proxy ignore DNT automatically. GPC is always honored and cannot be overridden. See Respecting Do Not Track and Global Privacy Control below.

What changes in cookieless mode

Behavior	Cookieless off	Cookieless on (default)
Page view tracking	Yes	Yes
Event tracking	Yes	Yes
Cookies / localStorage written	A visitor cookie is set for return detection	None, apart from the exit-intent widget marker described above
Visitor identifier	Persisted across the session	In-memory, page-scoped only
Returning visitor detection	Yes	Reduced (~10-15% fewer recognized)

Page views, events, traffic sources, device and browser data, and country-level geography are all still collected. The main thing you give up is reliable returning-visitor and cross-page session continuity, because there is no browser-side identifier to tie visits together.

When to use cookieless mode

A good fit for

• Sites that want to avoid browser storage entirely
• Privacy-sensitive industries (healthcare, legal, government)
• Teams that prefer the strictest possible client-side footprint

Less ideal for

• Sites that depend heavily on accurate returning-visitor counts
• Multi-page journey analysis where session continuity matters

If you are unsure, you can turn cookieless mode on, watch your returning-visitor numbers for a week, and turn it back off if the trade-off isn't worth it for your site.

Respecting Do Not Track and Global Privacy Control

Zenovay honors both Do Not Track (DNT) and Global Privacy Control (GPC) in the tracking script, independent of cookieless mode. The two are not treated the same way.

• GPC (navigator.globalPrivacyControl === true): the tracker stops before it sends anything. This check cannot be overridden, by attribute or by setting.
• DNT (navigator.doNotTrack === "1" or window.doNotTrack === "1"): the tracker stops before it sends anything, unless the DNT check has been switched off for that page.

Both checks run in the browser. Nothing on the server reads a DNT request header, so a request that reaches the ingestion API without running the script is not filtered by DNT.

Switching the DNT check off

data-ignore-dnt="true" switches off the DNT check only. It has no effect on GPC.

<script
  defer
  data-tracking-code="YOUR_TRACKING_CODE"
  data-ignore-dnt="true"
  src="https://api.zenovay.com/z.js"
></script>

Whether ignoring DNT is acceptable for your site depends on your jurisdiction and on what your privacy policy says.

Loading tracking only after consent

If you use a consent banner and only want to load analytics after the visitor agrees, load the script conditionally:

// Only load tracking after consent is granted
function handleConsent(granted) {
  if (granted) {
    const script = document.createElement('script');
    script.defer = true;
    script.src = 'https://api.zenovay.com/z.js';
    script.setAttribute('data-tracking-code', 'YOUR_TRACKING_CODE');
    document.head.appendChild(script);
  }
}

You can combine this with cookieless mode by also setting data-cookieless="true" on the injected script.

Legal context

Cookieless mode reduces what Zenovay writes to a visitor's device, which can simplify your compliance posture:

• ePrivacy / cookie rules: rules that hinge on storing or reading information on a device have less surface area when no cookies or localStorage are written.
• GDPR / CCPA: less persistent identification on the device means a smaller data footprint.

Cookieless mode is a technical control, not legal advice. Whether you still need a consent banner depends on your jurisdiction, the rest of your stack, and how you use the data. Review your setup with your own legal or privacy advisor, and describe your analytics accurately in your privacy policy.

Troubleshooting

Returning visitors look lower than before

This is expected in cookieless mode. With no browser-side identifier, repeat visits are harder to link, so unique-visitor counts trend higher and returning-visitor counts trend lower. It's a trade-off, not a bug.

Verify DNT / GPC in the browser

You can check the signals the visitor's browser is sending from the console:

console.log('DNT:', navigator.doNotTrack);
console.log('GPC:', navigator.globalPrivacyControl);

If GPC is set, the tracker will not record that visit. If DNT is set, the tracker will not record it either, unless you added data-ignore-dnt="true" or you load the script through the first-party proxy, which applies that override for you.

Next steps

• GDPR Overview
• Cookie Consent
• Data Collection Practices