Why your docs analytics doesn’t need a cookie banner

It helps to be precise about what triggers a consent banner, because "analytics" is not the trigger and a lot of people believe it is.

Under the ePrivacy rules that produced the banner you keep clicking, consent is about storing information on, or reading information from, a reader’s device. A cookie is the obvious case. So is localStorage, and so is a device fingerprint assembled from screen size, fonts and timezone. If you put an identifier on someone’s machine so you can recognise them next week, you need to ask first.

Counting how many times a page was served is not that. The request already reached your server; noticing it did is not storage on anyone’s device. The banner is not the price of knowing your traffic. It is the price of a particular way of measuring it.

This is an explanation of how the mechanism works, not legal advice. Your obligations depend on where you and your readers are, and on everything else your site loads. If you embed a third-party script, that script’s behaviour is yours to account for.

A conventional analytics script runs in the reader’s browser and sets an identifier that persists. That identifier is what makes the interesting numbers possible: returning visitors, sessions, time on page, a funnel across several days. Those metrics are the reason the identifier exists, and the identifier is the reason for the banner.

It is a fair trade for a shop. For documentation it is usually a bad one. You wanted to know which pages get read and where readers come from, and you have paid for it with a modal in front of your docs, a third-party script on every page, and a paragraph in your privacy policy about a company your readers have never heard of.

And the banner costs you the numbers anyway

The awkward part: a meaningful share of readers decline. Whatever you were measuring, you are now measuring the subset who clicked accept, and you have no way of knowing how that subset differs from everyone else. You have added friction to your docs and made your data worse in the same gesture.

The alternative is older than the banner. The server already knows a request happened; it records that, and derives what it needs without keeping anything about the person.

Here is the whole mechanism Docszero uses on published sites:

• A page is served. The server records the path, the referrer and the time.
• A visitor value is computed: a one-way hash of a secret, today’s date, the address and the user agent, truncated to 32 characters.
• The address itself is never written down. The hash is what gets stored.
• Because the date is an ingredient, the value changes at midnight. It cannot follow anyone into tomorrow, or across to another site.
• Known crawlers are recorded and flagged, so they can be excluded from the reader counts rather than inflating them.
• No cookie is set for any of this, so there is nothing to consent to.

What the hash can and cannot do

Within a single day, two requests from the same reader produce the same value, which is what makes "unique visitors today" a real number rather than a guess. Tomorrow the same reader produces a different value, which is what makes following them impossible — including for us. The secret means nobody can take a stored value and work backwards to an address.

This is not free. The daily rotation that makes the banner unnecessary is the same property that makes several familiar metrics impossible, and any page that tells you otherwise is selling something.

For documentation those trade-offs are mostly free. You want to know which pages carry the load, which ones nobody finds, and where readers arrive from, so you know what to write next. Multi-day attribution is a marketing question, and your docs are not a marketing funnel.

If you genuinely need cohorts and sessions across weeks, use a tool built for that and accept the banner. It is the right answer for the question you are asking.

Reader analytics is on for every published site, including sites on the free plan, and there is nothing to install: no snippet, no key, no third-party domain in your page.

• Views, unique visitors and a daily series for every site.
• Top pages and top referrers, ranked, on paid plans.
• Two days of history on Free, ninety days on Pro and Agency.
• CSV export on paid plans, so the numbers leave with you.
• No cookies, no sessions, no script, and no banner to add.

Protected pages are excluded from CDN caching for unrelated reasons, and none of this changes when a site is password-protected: the same counting applies, and the password cookie is a separate, necessary thing that has nothing to do with measurement.