We built a privacy-first analytics engine with zero cookies.
Alex Rivera
Principal Systems Engineer
By eliminating cookies from the ground up, applications using Tracabit are 100% exempt from intrusive consent banners under GDPR and ePrivacy.
Traditional web analytics platforms were born in the advertising era. They rely on persistent client-side tracking cookies (such as _ga and _gid) to follow users across days, weeks, and domains. When privacy legislation like GDPR and the ePrivacy Directive emerged, the tech industry slapped invasive cookie consent banners over websites rather than fixing the underlying architecture.
At Tracabit, we took a clean-sheet approach. We asked: Can you provide actionable, granular product telemetry without setting a single cookie?
Under EU ePrivacy Directive Article 5(3), consent is strictly required when non-essential data is stored on or retrieved from a user's terminal equipment. Because Tracabit uses zero cookies and zero persistent localStorage tokens, websites instrumented exclusively with Tracabit are completely exempt from consent banner obligations.
To compute 30-minute session boundaries without cookies, our edge CDN nodes compute a daily mathematical hash combining client IP, User-Agent, and a cryptographic salt that rotates automatically at 00:00 UTC. The raw IP address is discarded immediately in memory after Geo-IP country extraction.
Event payloads are written asynchronously to compressed ClickHouse MergeTree tables, enabling sub-5ms aggregations across millions of rows with 98.4% lower hosting overhead than legacy SaaS platforms.
// Non-reversible daily passive session hash (RFC 9110 compliant)
export function computeDailySessionHash(
clientIp: string,
userAgent: string,
dailySalt: string
): string {
// Hash combining IP, User-Agent, and 24-hour rotating salt
const rawInput = `${clientIp}:${userAgent}:${dailySalt}`;
return djb2Hash(rawInput);
}Written by Alex Rivera
Published on August 14, 2026 in Architecture & Privacy
Related Technical Articles
Continue reading deep dives into telemetry and privacy engineering.
Why zero-cookie analytics is the right default
Why consent banners degrade conversion by 28% and why anonymous mathematical minimization solves compliance permanently.
How to instrument a product without slowing it down
Legacy SDKs bundle 60KB+ of bloat. How we shrunk client telemetry to 1.8KB with non-blocking navigator.sendBeacon.
What agents need from your analytics API
Why LLM agents struggle with bloated JSON payloads and how structured Model Context Protocol (MCP) schemas bridge the gap.
Subscribe to our engineering journal.
Get technical teardowns, release announcements, and privacy engineering articles delivered once a month. No spam, ever.