Sessionization Without Cookies

What a cookie was doing

A cookie gave you a stable identifier across visits. Remove it and two things break: knowing a visitor is the same person tomorrow, and grouping today's events into sessions.

The second is solvable cleanly. The first is solvable partially, and it is worth being honest about which is which.

A rotating identifier

The common cookieless approach derives a daily identifier from request properties:

visitor_id = hash(site_id + ip + user_agent + daily_salt)

The salt rotates every day, which means yesterday's identifiers cannot be correlated with today's even by you. That is the property that makes it privacy-preserving rather than a cookie by another name.

Never store the inputs. Hash at ingest, write the hash, discard the IP.

Sessionizing with SQL

With a per-day identifier, a session is a run of activity with no gap longer than thirty minutes:

WITH gaps AS (
  SELECT user_id, timestamp,
         CASE WHEN timestamp - LAG(timestamp) OVER (
                PARTITION BY user_id ORDER BY timestamp
              ) > INTERVAL 30 MINUTE
              OR LAG(timestamp) OVER (
                PARTITION BY user_id ORDER BY timestamp
              ) IS NULL
         THEN 1 ELSE 0 END AS is_new_session
  FROM events
  WHERE site_id = ? AND timestamp >= ?
)
SELECT user_id,
       SUM(is_new_session) OVER (
         PARTITION BY user_id ORDER BY timestamp
       ) AS session_number,
       timestamp
FROM gaps;

The running sum over the new-session flag assigns a session number. It is the standard shape, and it is worth understanding rather than copying — every variation on session definition is a change to that CASE.

Thirty minutes is convention, inherited from early web analytics. Pick deliberately: a news site might use fifteen, a documentation site an hour.

What you genuinely lose

Be straightforward about this:

• Cross-day visitors. A daily-rotating id cannot tell you someone returned tomorrow. "Returning visitors" becomes "returning within the day".
• Cross-device. Never worked well with cookies either, but it does not work at all here.
• Long attribution windows. A 30-day conversion window needs identity that survives 30 days.

What you keep

Nearly everything most teams actually use: traffic trends, top pages, sources, funnels within a session, bounce rate, time on page, geography, devices, Web Vitals.

The honest framing is that cookieless analytics answers "how is my site doing" completely and "who is this specific person" not at all. For most teams that is the right trade, and it removes the consent banner.

Say what you measure

If "returning visitors" means "within the same day", label it that way. Analytics tools lose credibility by presenting a degraded metric under a name that implies more.