Cookieless tracking
Cookieless tracking measures or follows visitors without setting cookies, using techniques such as server logs, hashed IP addresses, URL parameters, local storage or device fingerprinting, and it is not automatically exempt from consent.The phrase covers very different things. At one end are privacy-focused analytics tools that count page views without storing anything on the device and without building profiles across sites; some, such as Plausible, derive a daily visitor identifier from a hash of the IP address and user agent with a salt that rotates every day. At the other end are techniques that replace the cookie with something harder to clear: fingerprinting, identifiers kept in local storage, or tracking parameters added to links.
The legal test in the EU is not whether a cookie is used. Article 5(3) of the ePrivacy Directive covers storing information on, and gaining access to information stored in, the user's device, and the EDPB's Guidelines 2/2023 confirm that this includes local storage, tracking pixels, URL tracking and fingerprinting where they access the device. A tool that stores nothing and reads nothing from the device beyond what is needed to deliver the page may fall outside that rule, but the GDPR still applies if the data it keeps can single out a person.
Google's Consent Mode is a separate case: without consent, its advanced implementation sends cookieless pings that Google uses for modeling, which is a design choice for consent, not an exemption from it. The guide to cookieless analytics options and the article on analytics without consent compare the approaches.