XPmetric

GDPR, cookieless tracking & tracking modes

How XPmetric's cookieless mode works (daily-rotating server-side hash), what the optional cookie mode changes, and when you need a consent banner.

XPmetric offers two tracking modes per site — you choose one when you create the site and can switch anytime in Settings → Sites:

  • Cookieless (default) — no cookies, no device fingerprinting, usually no consent banner needed for analytics.
  • Cookie (opt-in) — a single first-party cookie for maximum accuracy; depending on your jurisdiction you may need a consent banner.

Each mode has its own script, so switching modes changes your snippet — re-copy it from Settings → Sites → Get Script and redeploy.

For XPmetric's own legal terms, see the Privacy Policy.

Cookieless mode (default)

The cookieless script (p.js):

  • Sets no cookies on your domain
  • Computes no fingerprint on the visitor's device — the script sends no identity signals at all
  • Uses no cross-site identifiers

Visitor identity is derived on our servers: a hash of the visitor's IP address, user agent, and your site — salted with 32 random bytes that rotate every ~24 hours (UTC). The salt is random (not derived from any secret) and is deleted after it expires, so yesterday's visitors technically cannot be re-identified — even by us. Hashing includes your site's id, so the same person on two XPmetric-tracked sites never shares an identifier: cross-site tracking is impossible by construction.

This is the same design used by other privacy-first analytics tools to avoid consent banners: no long-lived profile of any visitor can exist.

The honest tradeoff

Because identity rotates daily, a visitor who returns tomorrow looks like a new visitor:

  • No new-vs-returning breakdown (it would be meaningless)
  • Visitor journeys are day-scoped — multi-day activity appears as separate visitors
  • Delayed revenue attribution weakens — a purchase days after the first visit can't be linked to the original traffic source
  • Visitor-scoped funnels can't complete across days (use session scope or a ≤24h window)

Daily aggregates — pageviews, visitors per day, top pages, channels, countries, goals — stay fully meaningful.

Cookie mode (opt-in)

The cookie script (p.cookie.js) stores a random visitor id in a first-party cookie (_xpm_id, 1 year) on your domain. It is never used across sites and contains no personal data — just a random id.

You get:

  • Accurate multi-day visitor journeys and returning-visitor stats
  • Reliable revenue attribution for delayed conversions
  • Visitor-scoped funnels with long windows

The tradeoff: a cookie used for analytics may require visitor consent in your jurisdiction (e.g. under the ePrivacy rules). That consent banner is your responsibility — XPmetric does not ship one.

Switching modes

Settings → Sites → Tracking mode. A confirmation dialog explains what changes. After switching, re-copy the snippet and redeploy — the old script keeps running in the previous mode until you swap it. Identity continuity resets at the switch (existing visitors get new ids).

No raw IP storage

In both modes, IP addresses are used only transiently at ingest — for country/city geolocation and (in cookieless mode) as hash input — and are never stored in analytics tables.

What you collect as site owner

Per pageview, XPmetric stores:

  • Page URL and path
  • Referrer and UTM parameters
  • Device type, browser, OS
  • Country and city (from geoip)
  • Custom events you explicitly fire

You are the data controller for your visitors' analytics. XPmetric processes this data on your behalf as a processor — see our Privacy Policy and Terms.

GDPR rights

Your visitors can exercise rights through you as the site owner. XPmetric account holders can export or delete their own account data from Settings.

Do I need a cookie banner?

In cookieless mode (the default) — no, for XPmetric analytics alone. You may still need consent for other tools (ads, embedded widgets, other analytics).

In cookie mode — possibly. You opted into a first-party analytics cookie; whether that requires consent depends on your jurisdiction. If in doubt, stay on cookieless mode — it's the whole point.

Related