Tracking website behaviour without third party cookies or IPs
3 min read · updated
You can learn what visitors are trying to do without knowing who they are. A first party identifier stored by your own site recognises a returning browser. Coarse location comes from the CDN's headers rather than the IP address. Behaviour is recorded as page views and engagement, not keystrokes. Retention is short, and anything identifying is added only when the visitor tells you who they are. That covers most of what conversion work needs.
What did third party cookies actually provide?
Mainly the ability to follow a person across different websites, which advertising used for retargeting and audience building. For understanding behaviour on your own site, third party cookies were never needed. Your own domain can recognise a returning browser with first party storage, and that is all on site analysis requires.
What signals are enough to read intent?
Which pages a visitor viewed and in what order, how long they stayed engaged, where they came from, whether they have been before, and what they clicked. From those you can tell a researcher from a buyer, a returning evaluator from a first time browser, and a shopper stuck at the cart from one who left after the first screen.
None of those needs a name, an email or an IP address. They need a first party identifier, event data and a sensible model of what each pattern means.
- Page sequence and engaged time
- Traffic source from UTM tags or referrer
- Visit count from a first party identifier
- Clicks on key elements such as pricing, cart and returns
How do you get location without an IP address?
Most CDNs and hosting platforms add the visitor's approximate country, region and city to each request as headers, derived at the edge. Your application can read those headers and discard the address itself, keeping the coarse location that analytics and personalisation actually use.
What about fingerprinting?
Avoid it. Fingerprinting combines device characteristics to recognise a browser that has cleared its storage or refused tracking. It is designed to work against the visitor's choices, browsers actively fight it, and it creates exactly the kind of identifiable data that privacy law is concerned with.
How does IntellQ track without identifying people?
IntellQ's tag keeps a first party visitor identifier in the site's own storage, reads coarse location from the CDN's geolocation headers, and stores no IP addresses. Engagement is measured per page block as seconds in view and click counts, with no text, form values or cursor tracks. A visitor becomes identified only when the site's own server signs an assertion, and identity is never inferred from an IP, an email in a URL or a fingerprint.
What do you give up, and does it matter?
Cross site retargeting and third party audience data are the main losses. For brands that relied on those for acquisition, that is a real change, but it is a change to advertising, not to understanding your own visitors. On your own site, a first party identifier, event data and coarse location cover nearly every question conversion work asks.
You also give up certainty about individuals. A visitor who clears storage or switches devices appears as new. For aggregate decisions, such as which page loses buyers, that noise washes out. For decisions about one person, wait until they tell you who they are, by logging in or placing an order.
What you gain is simpler compliance, fewer vendors holding your customers' data, and a lighter page.
When you evaluate a tool, ask for its data dictionary: the exact fields stored per visitor and per event. A vendor that can produce it in a day has thought about privacy. One that cannot is probably storing more than it needs, and you will be the one explaining it later.
Privacy first tracking is also easier to explain to customers. A notice that says what is measured, in one sentence, builds more trust than a banner nobody reads.
Questions
Is first party storage the same as a cookie?
Technically it may use cookies or local storage on your own domain. The difference that matters is that only your site can read it, and it cannot follow the visitor across other sites.
Can I personalise without knowing who the visitor is?
Yes. Most useful personalisation reacts to behaviour on this visit and earlier visits, which a first party identifier provides without any personal details.
Does privacy-first tracking lose accuracy?
For on site behaviour, very little. What it gives up is cross site tracking and identity resolution, which conversion work rarely needs.