You can configure SlimStat to record eligible visits without its tracking cookie. Whether that configuration is appropriate for your site depends on more than cookies: other identifiers, consent, retention and your site’s obligations still matter.
Which settings control cookieless tracking?
Open SlimStat → Settings → Tracker and review Set tracking cookie, Anonymize IP addresses, Hash IP addresses, GDPR compliance mode and the selected Consent plugin integration. Turning off Set tracking cookie suppresses the SlimStat visit cookie; it does not automatically remove every identifying field.
The table lists each setting’s default in a new install and what changes when you switch it. Existing settings are preserved when upgrading.
| Setting | Default | What changes when you switch it |
|---|---|---|
| Set tracking cookie | On | Off: SlimStat sets no visit cookie, and returning-visitor detection gets less accurate |
| Anonymize IP addresses | Off | On: the end of each address is masked before storage: the last IPv4 octet becomes 0, and the last 80 bits of IPv6 are removed |
| Hash IP addresses | Off | On: a one-way hash of the IP address, user agent and a daily salt is stored instead of the address, and the hash changes every day |
| GDPR compliance mode | Off | On: SlimStat requires consent before tracking, read from the Consent plugin integration you select |
What still works without the cookie
With Set tracking cookie off, SlimStat still records every pageview, but it no longer links one pageview to the next. Each pageview is recorded as a visit of its own, so the reports built on visits change meaning.
| Report | Without the cookie |
|---|---|
| Pageviews | Recorded as before |
| Visits | Each pageview counts as a new visit, so visit counts rise toward pageview counts |
| Entry pages, exit pages and visit duration | Every visit is one page long, so these reports no longer show paths through the site |
| Returning visitors | Detected less accurately, as the setting’s own description warns |
| Goals | Total still counts every matching pageview or event; Uniques lose accuracy for the same reason as returning visitors |
Keep the cookie on if visit-level reports matter to you, and collect consent for it where your site needs consent.
What happens to sessions?
Cookie-based visits and anonymous visits use different identity paths. SlimStat 6 adds a full-width cookieless identity field and corrects session splitting and duplicate pageviews in specific anonymous/consent-upgrade paths. Do not compare totals with an older version without reviewing these changes.
Read the v6 upgrade notes. A hashed identity is still an identifier; do not describe it as proof that a person cannot be distinguished.
What can still be recorded?
Depending on consent and settings, records can include page paths, referral URLs, browser/device details, interactions and location. URLs may themselves contain personal information. Logged-in activity and fingerprint-related behavior need their own review, rather than an assumption that removing the cookie removes all identity.
Geolocation depends on permission to collect its fields and the configured provider. It is not guaranteed to remain available in every cookieless or anonymous mode.
Test your actual configuration
- Configure the tracking and consent settings for your intended policy.
- Clear page caches and open a fresh private browser session.
- Inspect cookies and the Access Log before making a consent choice.
- Test reject, accept and withdrawal separately.
- Inspect stored fields and check that no unwanted identifiers appear.
Use the consent integration guide and tracking checklist if behavior differs from your expectations.
Is server-side tracking automatically cookieless?
No. Tracking Mode chooses where pageviews are recorded. Cookie and consent settings are separate. Use Client mode with a full-page cache; Server mode only sees eligible requests that reach PHP.
Does removing cookies establish legal compliance?
No single setting establishes that. Review the whole collection and retention process for your site. SlimStat provides technical controls, not a legal conclusion.
Where should I start?
Install Free, configure privacy controls, and test one recorded visit. Set a retention policy that includes archive tables and backups.