DatalenkDatalenk
← Features
Product

Cookieless Analytics: Nothing on the Device by Default

By default Datalenk writes nothing on the visitor's device: no cookies, no localStorage. Before consent, Simple measurement only; everything that links or remembers waits for your visitors' consent. EU-hosted.

4 min read

By default, Datalenk stores nothing on the visitor's device. No cookies, no localStorage. The script still reads standard browser information (language, screen size, referrer) and sends it with each event, so the law on trackers applies: before your visitors' consent, Datalenk runs Simple measurement only, and everything that ties a visit to a sale, a campaign or a person waits for that consent. We tell you exactly which is which.

Tracking depth is a layer you choose, not a default we hide

We made the tracking layers explicit, and the shallow one is the default.

  • Simple measurement (before consent): nothing written to the device. Visits are stitched server-side within the day, with a hash that includes the date, so nobody, including us, can follow a person from one day to the next. You get page views, the referring domain, devices and countries, with no campaign parameters, no click ids and no payment linking.
  • After consent: campaigns (UTM, click ids), revenue by channel, the link to Stripe and Calenkli, A/B tests and replay. Your consent banner passes each visitor's answer to Datalenk with one call, datalenk.consent(true).
  • Persistent (opt-in, per site): stores, only after the visitor's consent, a pseudonymous random ID (localStorage plus a first-party cookie your own backend can read), for 90 days from the first time it is stored, never extended. It unlocks returning visitors, multi-day attribution and multi-session journeys. It is personal data under the GDPR: say so in your privacy policy.
  • Identity (your call, in your code): one datalenk.identify(email) at login welds a person to their acquisition channel, across devices. It waits for the visitor's consent. Nothing is stored on the device, and the email is HMAC-hashed server-side with a secret pepper. We never keep it in clear text.

What it does

  • Simple measurement before consent: page views, referring domain, device, country, region and city, with nothing stored and no campaign or sales linking.
  • One call for your consent banner: datalenk.consent(true) or datalenk.consent(false), and Datalenk waits for it.
  • An opt-out link for your privacy policy: one attribute gives your visitors a "Stop measuring me on this site" link.
  • Do Not Track honored: if the browser sends the signal, the tracker disables itself entirely. Nothing is collected, nothing is stored.
  • EU-hosted: servers and databases in the European Union (Hetzner), on our own ClickHouse and Postgres. Cloudflare, a US company, sits in front of our domains as a CDN and sees requests in transit, without storing analytics data; every provider is listed on our sub-processors page.
  • Your own subdomain, if you want it: point a CNAME at us and the script loads from your domain. It changes none of the rules: without your visitors' consent, only Simple measurement runs.
  • No raw IPs, ever: an IP is used in-memory to derive a coarse location (country, region, city), then discarded.

We say "GDPR-friendly by design", never "100% compliant, guaranteed", and never "certified" or "validated" by a regulator. Cookie law is interpreted differently across member states and vendor marketing is not case law. What a cookieless, EU-hosted tool gives you is a strong, documented, good-faith position and the smallest possible exposure, not magic immunity.

We hold ourselves to the same standard: datalenk.com asks its visitors' consent before using the Persistent layer and replay, and says so in its privacy policy.

Why this matters now

Platforms keep making measurement depend on their goodwill, and the legal basis for EU-US data transfers has been struck down twice by the EU Court of Justice, in 2015 and 2020, before the current framework was adopted in 2023. A tool whose default collects nothing on the device, on EU infrastructure, keeps your measurement independent of how the next round of that litigation ends.

Go deeper

What GDPR actually requires from analytics: ↗. The EU-hosted landscape and where Datalenk sits: ↗. Why the Schrems litigation matters: ↗.

Measure what matters, the right way. Cookieless by default, EU-hosted. 14-day trial, card required. Start your trial.

FAQ

Do I need a cookie banner? It depends on what you measure. As soon as you tie your sales to their source, run an A/B test or recognise a visitor from one day to the next, you must ask your visitors' consent: Datalenk waits for it, and gives you the setting and the code your banner calls. Before consent, only Simple measurement runs.

Where is my data hosted? Servers and databases in the European Union (Hetzner). We run our own ClickHouse and Postgres.

How accurate are unique visitors without cookies? Very close for practical purposes, within the day. A daily hash estimates uniqueness with a small trade-off at the edges. Across days, a visitor who returns counts as new, which is exactly what "we do not follow people over time" means. If you need the returning-visitor number, that is what the Persistent layer is for, with your visitors' consent.