Is Cookieless Tracking Legal? EU, US, Canada, Australia

Cookieless tracking is the promise you will find on a growing number of ad measurement tools: "100% accuracy, even with cookies rejected, history cleared and an ad blocker on." Technically that usually means browser fingerprinting or IP-based matching, and legally the answer depends on where your customers live: in the EU such identification requires consent (which breaks the whole promise), while the US, Canada and Australia have different, but not nonexistent, rules. This guide explains how the techniques work, what regulators say market by market, and what the lawful alternative looks like. We are not lawyers and this is not legal advice; every fact was verified on 10 August 2026 and we cite primary sources.

What does cookieless tracking actually mean?

Cookieless tracking in practice means one of three techniques, and none of them means "no storing or reading of data on your device". When a vendor promises to recognize a visitor without a cookie, it uses:

1. Server-set first-party cookies: the cookie is set via the store's own server on the store's own domain, sidestepping Safari's 7-day cap on script-set cookies. It is still a cookie; only the way it is set changed.
2. IP address and browser matching: the server links an ad click to a purchase by combining IP address, device characteristics and timing. The identification is probabilistic ("most likely the same person"), and under EU case law an IP address is personal data.
3. Browser fingerprinting: a script assembles a signature from device properties unique enough to recognize you without any stored identifier at all.

All three techniques answer the same question ("is this the same visitor?") by reading data from the device. That reading is exactly what European law regulates, so "cookieless" is a technical detail, not a legal shortcut. A legal cookieless branch does exist: privacy analytics that measure only aggregates without recognising the visitor, sorted in our GA4 alternatives guide.

How browser fingerprinting works

A browser fingerprint is built by reading dozens of device properties and hashing them into a signature: how the graphics card renders hidden text onto a canvas, how an audio signal is processed (AudioContext), which fonts are installed, screen resolution, CPU core count, languages, timezone. Each property says little; together they are often enough to recognize you with nothing stored at all.

How much is "enough"? The honest numbers from research: the pioneering EFF study (Eckersley, 2010, 470,000 browsers) measured 83.6 percent uniqueness, the AmIUnique project (2016, 119,000 browsers) 89.4 percent, and the "Hiding in the Crowd" study (2018) measured only 33.6 percent uniqueness across 2 million visitors of a general-audience French news site. The gap is no accident: volunteers who test their own browsers are more "special" than the general population. Fingerprinting is a powerful tool, but "every browser is unique" is marketing, not science. Commercial systems therefore combine fingerprints with IP addresses and first-party identifiers, and re-link signatures when they drift.

The 2025 context matters too: in February 2025 Google's ads platform policies started permitting fingerprinting by advertisers again, and the UK regulator ICO publicly called the change "irresponsible", warning that businesses "do not have free rein". Browsers, meanwhile, actively fight the technique: Safari presents simplified device signals, Firefox blocks known fingerprinting scripts, and Brave randomizes the signature on every session.

Is browser fingerprinting legal in the EU without consent?

No. European regulators answered this question back in 2014: the Article 29 Working Party's Opinion 9/2014 states that device fingerprinting falls under Article 5(3) of the ePrivacy Directive, meaning prior consent, explicitly including its use for website analytics and online advertising. The EDPB confirmed and extended this in 2024 with Guidelines 2/2023, which bring tracking pixels and certain forms of IP-based tracking into the scope of Article 5(3) as well.

The two common vendor counterarguments fail in court. "We store nothing" does not help, because Article 5(3) also covers reading information from the device, not only storing it. "It is not personal data" was rejected by the EU Court of Justice in Planet49 (2019): the rule applies whether or not the information is personal data, and an identifier joined to an order and email is personal data under GDPR anyway (Recital 30; Breyer for IP addresses). The only consent exemptions are carrying out a communication and a service the user explicitly requested; analytics and ad attribution, by the regulators' uniform position, qualify as neither.

Enforcement so far names trackers generally rather than fingerprinting specifically: we found no EU fine that names browser fingerprinting as the central violation, but fines for tracking without valid consent are routine, with France's CNIL ordering 325 million euros from Google and 150 million from Shein in September 2025 alone.

The rules by market: EU, US, Canada, Australia

The rules for recognizing visitors without cookies differ across markets more than almost any other ecommerce question, so a store selling globally needs to know where its buyers are. Status as of 10 Aug 2026:

Three details the table cannot carry. In the US, California's CCPA explicitly lists device fingerprints among "unique identifiers", requires honoring the Global Privacy Control signal, and is producing real fines (Sephora, Honda, Todd Snyder), while a wave of CIPA wiretapping lawsuits targets covert website tracking. In Canada, the OPC's behavioural-advertising guidance names techniques users cannot opt out of, fingerprinting specifically, as unacceptable for advertising, and Quebec's Law 25 requires profiling functions to be off by default. In Australia, the first tranche of the 2024 privacy reform introduced a statutory tort for serious invasions of privacy, and the announced second tranche (a broader personal-information definition, a fair-and-reasonable test) will move the rules toward Europe's.

Why 100% tracking and valid consent cannot coexist

The claim "we track 100% of visitors" and valid consent are logically incompatible: if visitors have a real option to say no, some of them do, and a lawful tool must not recognize those visitors. A tool that still sees everything after a refusal is, by definition, tracking people who declined. That is not a configuration mistake; it is the business model.

So the real question for any "cookieless" tool is simple: what happens to an EU visitor who clicks Reject on the banner? If the answer is "nothing changes, we still recognize them", the tool operates in the EU in exactly the way WP29, the EDPB and national regulators say requires consent. If the answer is "we lose that visitor", the 100% promise is not true. There is no third option; honest measurement means measuring the gap, not hiding it.

For the constructive side of the argument (what to build instead of fingerprinting), see our privacy-safe attribution stack.

Questions to ask your tracking vendor

Ask any ad tracking vendor the following before signing, and ask for written answers; the questions are designed to separate lawful architecture from risky architecture without you having to trust marketing pages:

1. Which signals identify a returning visitor who rejected or cleared cookies?
2. Does identification run before or after the consent banner decision?
3. What exactly happens to EU traffic when a visitor clicks Reject?
4. Which Article 5(3) ePrivacy exemption do you rely on, given that WP29 Opinion 9/2014 excludes analytics and advertising?
5. Do you join the identifier to the order (which makes it personal data under GDPR)?
6. Where is the data hosted, and will you sign a data processing agreement (DPA)?
7. Do you honor the Global Privacy Control signal for US visitors?
8. Who carries the liability if a supervisory authority judges your method differently than you do?

A vendor with clean architecture answers these without detours. Evasion on questions two, three or four tells you everything you need to know.

How Enalitica tracks without fingerprinting

Enalitica does not recognize visitors by fingerprint: our tracking script reads no canvas, WebGL, audio, font or hardware signals and uses no probabilistic IP matching. Instead it stores what the ad platform itself attached to the link: the click ID (gclid, fbclid and similar) and UTM parameters, in a first-party cookie on the store's own domain with a 90-day lifetime. An order is joined to a campaign through that click ID, provably and deterministically, never by guessing.

Consent is built into the script: it detects common banners automatically (Cookiebot, CookieYes, OneTrust, Complianz, Iubenda, any IAB TCF-compliant CMP) and stores nothing until consent arrives, with silence counting as no. What we cannot prove, we show honestly: orders without evidence of a source land in their own Unknown bucket, never inflated into Direct, why that matters is covered separately. Data is hosted on EU servers (Helsinki), and customer personal data is encrypted with a key separate for every store.

One honest boundary, stated plainly: consent on the store's site is governed by the merchant's banner, and the script honors it whenever it can read it. Server-side reporting of completed purchases to ad platforms (for smart bidding) rests on the merchant's separate legal basis toward its own customers, not on the banner; that is the difference between tracking visitors and reporting your own sales. If you want to see how this looks on your data, create a free account or book a live demo.

Checklist for a store selling globally

1. You know what share of your customers comes from the EU/EEA, US, Canada and Australia.
2. The consent banner works, and your tracking tools actually read it (test with Reject).
3. The cookie policy lists every cookie that actually gets set, including third-party tools.
4. For every tracking tool you have a written answer on how it recognizes visitors without cookies.
5. You have a signed data processing agreement (DPA) with the tool and know where it hosts data.
6. For US visitors you honor Global Privacy Control where state laws require it.
7. You treat the Unknown share in your reports as a measured boundary, not as an error to "fix" with more aggressive tracking.
8. Budget decisions rest on profit from orders, which needs no grey tracking trick to compute.

Frequently Asked Questions

Is browser fingerprinting banned in the EU?

It is not banned, but it requires prior consent, exactly like cookies: WP29 Opinion 9/2014 and EDPB Guidelines 2/2023 place fingerprinting explicitly under Article 5(3) of the ePrivacy Directive. What is effectively prohibited is its typical use: recognizing visitors without asking, which is the very reason the technique gets used.

Does cookieless tracking require consent?

In the EU usually yes, because "cookieless" does not mean "without reading data from the device": Article 5(3) covers any storage or access on terminal equipment, and Planet49 confirmed it applies even to non-personal data. In the US no prior consent is needed, but notice, opt-out rights and the GPC signal apply; in Canada the regulator disfavors fingerprinting for ads, and Quebec requires profiling off by default.

What is a browser fingerprint?

A browser fingerprint is an identifier assembled from your device's properties: hidden canvas rendering, audio processing, installed fonts, screen resolution, hardware details and similar signals. Studies measured between 33.6 and 89.4 percent uniqueness depending on the population. Because nothing needs to be stored, it survives cookie deletion and private browsing, which is why users effectively cannot avoid it.

Did Google allow fingerprinting?

As of 16 February 2025, Google removed the ban on fingerprinting by advertisers from its ads platform policies. That is a change of Google's business rules, not of the law: the UK ICO called the move irresponsible and warned that companies must still comply with GDPR and PECR, and in the EU Article 5(3) applies exactly as before. A platform's permission is not a legal basis.

What happens to orders from visitors who reject cookies?

With lawful measurement you lose those visitors' browser journey, not their orders: the order exists in the store and lands in Enalitica's Unknown bucket instead of being wrongly credited to Direct or some channel. Part of these orders can be honestly explained through server-side click ID capture at checkout; the remainder is the measured price of privacy, better known than hidden.