Anonymous tracking: How to do useful analytics without personal data

When faced with the many restrictions on collecting and using personal data in web analytics, you might ask yourself: Can I do useful web analytics without personal data?

The simple answer is yes. Although you won’t be able to draw the same conclusions as with personal data tracking, anonymous data collection methods absolutely do provide you with valuable insights into user behavior.

Regulations worldwide, like GDPR or the ePrivacy Regulation, set a high bar for collecting user data. For one, GDPR requires consent to process the data if it’s reasonably likely that such data could be used to identify an individual. The problem is that consent opt-in rates typically vary between 30% and 70-80%.

The solution?

Anonymizing data about users who don’t consent to personal data processing.

Benefits of anonymous data collection

Analytics platforms featuring anonymous data collection, such as Piwik PRO, offer a viable path to processing user data instead of an all-or-none choice based on consent.

The core benefits of anonymous data include:

• You are not dealing with personal data because there is no visitor identification.
• You are not using the collected visitor data for other purposes (for instance, Google uses the data for advertising and to improve its services).
• You are not transferring data outside the EU.

With anonymous analytics, businesses can gain valuable insights into user behavior, preferences, and pain points while respecting user privacy and complying with data protection regulations.

Anonymous tracking – how it really works

Piwik PRO gives you three anonymous tracking methods to choose from:

Anonymous tracking with cookies and session data

In this scenario, Piwik PRO deploys a cookie that collects session data but no personal data. The session lasts 30 minutes, after which the web browser removes the identifier.

In this case, session tracking collects events and binds them into a session. The individual cannot be identified or tracked across sessions, so a user can’t be identified as a returning visitor.

The major advantage of this approach is that it gives you more trustworthy data than any other anonymous data tracking method. This method doesn’t create duplicate sessions. Plus, if a visitor decides to grant consent during their session, the session identifier turns into a first-party tracking cookie that will last longer than 30 minutes.

This is a good approach if you need to comply with strict privacy laws.

Anonymous tracking without cookies but with session data

In this method, Piwik PRO deploys an identifier in the form of a session hash. No cookies are created or stored in visitors’ browsers.

The session hash is temporary and kept for 30 minutes after the visitor’s last action. This type of identifier isn’t persistent or used for any analysis.

The platform collects only session data, without personal data. The session hash ties events, such as page views, to one session.

The major advantage of this method is that it’s permissible under several privacy and cookie regulations, such as Germany’s TTDSG/TDDDG. The downside is that it is less precise in differentiating visitors, meaning sessions of different visitors may be glued together. The severity of this issue depends on the industry.

Anonymous tracking without cookies or session data

This method can’t identify an individual and can’t be used to pinpoint a single session. There are many pieces of data this approach doesn’t track, such as time spent on page, bounce rate, user flows, funnels or channel attribution.

It’s the strictest way to collect anonymous data that removes the risk of breaching privacy laws. Despite the lack of visitor and session data, this method is still useful in many business use cases.

Here is a summary of these anonymous data tracking methods:

Piwik PRO tracking methods	Anonymous data tracking with cookies and session data	Anonymous data tracking without cookies but with session data	Anonymous data tracking without cookies or session data
Tracking technology	First-party session cookie and session hash	Session hash
Visitor data
Session data
Event tracking
New vs. returning visitors
Consent mechanism	You can choose full visitor data tracking for visitors who consent and anonymous data tracking for those who ignore the banner or don’t consent	You can choose full visitor data tracking for visitors who consent and anonymous data tracking for those who ignore the banner or don’t consent	No consent required
All traffic
Traffic sources
Visitor’s location	Country, continent	Country, continent	Country, continent
Channel attribution	Last-click	Last-click

All three anonymous tracking methods work under the following conditions:

• The geolocation is based on anonymized IP addresses or is deactivated.
• No personal data is tracked and stored in the database without explicit consent.
• Visitors who don’t consent appear as one-time visitors and can’t be identified across sessions, and their actions can’t be tied across multiple sessions. You won’t be able to determine if actions were performed by a returning visitor.

You can get the most value from the two tracking methods that bind the collected event data into sessions. Whether you use the solution with a cookie or session hash depends on your preference and your company’s situation. For example, a session hash will be a safer choice if you are subject to strict cookie laws.

On the other hand, full anonymous tracking only collects events, making it a more limited source of information. But it still works when session or user-level data isn’t necessary.

Sample use case for anonymous data tracking in Piwik PRO

Let’s consider a specific scenario:

A visitor enters a tracked website from Google organic search and doesn’t give consent. They visit a page with an article and read it, view a banner with the promo code for subscribing to a newsletter, and then subscribe to the newsletter. After a few hours, they enter the website once more, view a product list, and make a purchase.

Here is what this visitor’s actions will look like for each type of anonymous tracking.

Cookies and session hash

• The visitor’s IP address is completely erased.
• Geolocation is limited to the country level.
• The visitor’s actions create a session.
• The visitor completes a goal: subscribes to the newsletter.
• The visitor enters a funnel defined for the tracked website.
• During the subsequent session, the user is not recognized as a returning visitor.
• The visitor’s purchase is not attributed to Google organic search channel – it’s classified as Direct.
• Most metrics in Audience, Behavior, and Video Overview are accurate.

No cookies but session hash

This option works in a similar way to the one with cookies and session hash. Due to the nature of cookies, the method with cookies is more resistant to cases when browser setup or IP address changes. Thus, in some cases, the option without cookies and with session hash can be a bit less accurate.

No cookies, no session hash

With this method:

• The visitor’s IP address is completely erased.
• Geolocation is limited to the country level.
• The visitor’s actions do not create a session.
• The visitor completes a goal: subscribing to the newsletter. The goal is not assigned to a specific session.
• The visitor does not enter a funnel defined for the tracked website.
• During the subsequent session, the visitor is not recognized as a returning visitor.
• The purchase is attributed to the Direct channel.
• Metrics like the number of page views, downloads, outlinks, site searches, and custom events (event-scoped metrics) appear correctly.

Anonymous data tracking and personal data tracking

Now, let’s say a visitor ignores the consent banner, browses for 15 minutes and then consents for you to use their personal data for personalization.

The data from those 15 minutes of browsing can now be added to their record using a cookie with a longer lifetime – in the case of Piwik PRO, it’s 12 months.

Initially, such data was anonymous, but now it can be used for personalization every time this person visits your website.

How to use anonymous analytics data in your marketing activities

Anonymous analytics data can be effectively used for monitoring patterns in user behavior, detecting potential issues to proactively address, and spotting opportunities for marketing optimizations.

Here are some specific marketing activities that you can use anonymous data for:

• Campaign performance tracking: Analyze the effectiveness of marketing campaigns and identify areas for improvement by measuring anonymous traffic sources, engagement metrics, and conversion rates.
• Content optimization: Identify top-performing content by tracking page views, time on page, bounce rates, unique visitors, and traffic sources. Learn what resonates with your audience and adjust your content strategy, including the formats and channels you use.
• A/B testing: Conduct A/B tests on different site or app elements, such as headlines, calls-to-action, or layouts. Analyze engagement metrics such as clicks, conversions, and time on page to improve user experience and conversion rates.
• Referral source analysis: Evaluate the quality of referral traffic by analyzing anonymous sessions from different sources, such as social media, search engines, or affiliate links.
• Localization insights: Leverage anonymous geographic data to identify potential markets to target with your marketing efforts, localized content, or product offerings tailored to specific regions.
• In-session audience segmentation & data activation: Analyze trends in user behavior and segment users based on their behavior or interests. Identify opportunities to serve contextual content, recommendations, or ads during the same session.
• Engagement analysis: Examine user interactions on your website or app to identify popular features and areas of high engagement or friction. This can help you optimize layouts, navigation, and content placement and guide development plans without tracking individual users.
• Site or app performance tracking: Analyze page load times for users across devices and network conditions to improve performance across different environments. Identify and prioritize fixing errors or bugs based on their impact on user sessions.

Sample marketing use case: Audience segmentation for ad slot optimization under privacy laws like GDPR

As a publisher, you can utilize anonymous, single-session data to segment your audience based on their consent preferences for tracking and personalized advertising and comply with privacy regulations. You’re able to leverage anonymous data even before obtaining consent to start optimizing ad delivery from the very first page view while still respecting user privacy choices later on.

For example, you might want to show more ad slots to visitors who opted out of tracking or ignored the consent banner and fewer ad slots to those who opted in. For the opt-out segment, you increase the number of ad slots to compensate for the lower ad relevance and value. For the opt-in segment, you can show fewer ad slots without compromising revenue since the ads being shown are more valuable.

You can use a consent management platform (CMP) to facilitate user consent collection. Additionally, a tag management system (TMS) lets you implement and optimize the ad slot strategy without heavy reliance on IT resources. By integrating appropriate tags, you can load ad slots dynamically based on rules and data signals and capture users’ consent choices.

You can then set up rules in the TMS to segment anonymous traffic into opt-in and opt-out groups based on the consent data from the CMP:

• For the opt-in segment, configure the TMS to load the standard number of ad slots and pass any available session-level behavioral data to the ad server for personalized ad targeting.
• For the opt-out segment, increase the number of ad slots loaded by adjusting the ad server container settings in the TMS. These can be contextual, non-personalized ad placements.

You can then continuously monitor ad performance metrics within your Analytics, split by segment, and iteratively optimize the ad slot density and ad server settings via the TMS.

Limitations of anonymous data tracking in marketing

The lack of persistent tracking means your anonymous data can’t be fully used for certain marketing activities.

Here is a breakdown of marketing tactics that are possible with full tracking but are limited or impossible to perform with anonymous tracking:

Marketing tactic	Anonymous data tracking	Full tracking
Personalized Recommendations	Limited – Can provide basic content or product recommendations based on current session behavior	Possible – Can leverage comprehensive user profiles and historical data for highly personalized recommendations
Retargeting/Remarketing	Not Possible – Cannot identify and retarget individual users across sessions	Possible – Can retarget users based on their previous interactions and behaviors
Customer Lifetime Value Analysis	Not Possible – Cannot track individual user journeys and purchases over time	Possible – Can analyze lifetime value by linking user data across multiple sessions and transactions
Predictive Analytics	Limited – Can only make predictions based on current session data	Possible – Can leverage historical user data to build predictive models for behaviors, churn, etc.
Omnichannel Personalization	Not Possible – Cannot identify and sync user experiences across multiple channels	Possible – Can provide seamless, personalized experiences by recognizing users across web, mobile, email, etc.

Can a website visitor block anonymous tracking?

Since one of the methods is based on a session cookie, you may wonder if it will still work if the visitor blocks cookies, for example, through their browser settings or an ad blocker. There are a few things to clarify:

1. Most of the tracking cookies contain personal data, but there are exceptions. The session identifier cookie, which Piwik PRO uses for anonymous data collection, doesn’t collect any personal data, as the web browser automatically deletes it after 30 minutes. It’s unlikely to identify a person based on the actions taken on a single website.
2. In many EU countries, privacy-friendly analytics is exempted from the consent requirement. For example, CNIL, the French data protection authority, has added Piwik PRO Analytics Suite to the list of analytics platforms that can be used to collect data without consent, given a certain configuration and set of limitations.
3. First-party cookies are rarely blocked. Browsers and ad blocking software are getting more successful in detecting third-party scripts. That said, analytics experts estimate that only about 1% of Internet users deactivate JavaScript or block all cookies. And if that’s not enough, you can always switch to the session identifier without a cookie.

Analytics without personal data – a long history and a promising future

Although anonymous data collection is still rare in web marketing and analytics, it has a long and effective history in other fields.

Companies need to respond to the data privacy demands of Internet users around the world. Luckily, anonymous data collection methods, like the ones available in Piwik PRO Analytics Suite, will be your friend in achieving it.

Learn more about privacy-compliant ways to collect analytics data:

• 6 ways analytics software collects data online
• Collect data in a privacy-friendly way
• Cory Underwood: US businesses are interested in how the changes in privacy laws in Europe affect data collection