How to track website traffic without GA4

Why teams are leaving GA4

GA4 was designed for organisations with a dedicated data team, a tag manager, and a BigQuery warehouse. For a bootstrapped SaaS founder or a small ecommerce operator, four problems show up almost immediately — and each one has hard data behind it.

1. Cookie consent loss. GA4 sets cookies, which means the EU ePrivacy Directive requires a consent banner. Independent measurements show rejection rates of 50–60%+ when a clear "Reject all" button is on the first layer^[4], and 68.9% of visitors close or disregard the banner entirely^[5]. EDPB Guidelines 2/2023 confirmed the consent requirement applies to a much broader range of tracking technologies than cookies alone^[7], raising the legal bar further.
2. "Direct / none" pollution. When the referrer is stripped — a default behaviour for Chrome since v85 in cross-origin requests^[9] and a documented limitation of HTTPS→HTTP transitions^[8] — GA4 buckets the visit as direct. Industry analysis shows only 10–15% of GA4 direct traffic is genuinely direct; the rest is misclassified social, email, app, and AI traffic^[14][21].
3. Sampling above 10M events. GA4 standard properties begin sampling exploration reports the moment a query exceeds 10 million events within the selected date range^[1]. Configuration limits are documented but rarely surfaced in reports themselves^[2].
4. Enterprise UX. Custom reports require event parameters, dimensions, and a steep learning curve. The default reports rarely answer the question a founder actually has: "which channel brought paying customers this week?"

What cookieless analytics actually does

Cookieless analytics counts visits without storing identifiers in the browser. Instead of a persistent cookie, tools like Attrifast use a server-side hashed ID derived from IP + User-Agent + a daily-rotating salt. The hash cannot be reversed to identify a person and expires every 24 hours — so it is not personal data under GDPR. EDPB Guidelines 2/2023 makes this distinction explicit: storage of or access to information on the user's device triggers consent; aggregation that never touches the device does not^[7]. France's CNIL, Spain's AEPD, and Italy's Garante have published narrow exemptions for first-party aggregate analytics under exactly these conditions^[20].

The trade-off: returning-visitor accuracy is reduced beyond a 24-hour window. For traffic and revenue attribution this almost never matters, because what you care about is the source of the first visit and the source attached to a payment, both of which fit comfortably inside a session.

Browser market share is not your friend

Two thirds of the cookie-tracking conversation focuses on Chrome's third-party-cookie phase-out. The bigger immediate problem for analytics is Safari Intelligent Tracking Prevention (ITP). Since 2019, Safari has capped JavaScript-set first-party cookies at 7 days; since Safari 16.4 (April 2023), even server-set first-party cookies are capped at 7 days when delivered via a CNAME the browser considers tracking-related^[6]. The 30-day site-data purge applies to all first-party storage when a user doesn't return.

Why this matters: in mobile, Safari's share is 19.52%^[12] globally. Combined with desktop, Safari is roughly 14% of total browser share^[11]. That's ~14% of your audience whose returning-visitor cookies expire every week. Every cookie-based analytics tool that promises "monthly active users" or "new vs returning" segmentation is silently inflating "new" on Safari traffic.

Comparison: GA4 alternatives in 2026

Five tools dominate the privacy-first analytics category. Each has a different focus. All pricing below is the publicly listed monthly rate verified against the vendor's own pricing page or independent reviews — see citations.

Attrifast is the only tool in this list with native, automatic Stripe revenue attribution — so the dashboard pairs traffic source with paying-customer revenue out of the box. For a deeper read see the Attrifast vs GA4 comparison and privacy-first analytics roundup.

AI traffic is the new dark direct

The fastest-growing referrer category nobody is tracking properly is AI. Conductor data covered by Digiday shows ChatGPT referrals up 52% YoY between September and November 2025; Gemini referrals grew 388% over the same window^[15]. But MarTech's analysis of GA4's source/medium classification confirms a serious blind spot: native AI chat apps (ChatGPT iOS/Android, Claude mobile, Perplexity Comet) generally strip the Referer header before they navigate to your site^[16]. The result is that a fast-growing slice of high-intent traffic shows up as "direct / none" in GA4.

Cookieless tools mitigate this by combining the referrer with known-domain matching: when a visit shows no referer but its landing URL contains a known UTM or click-ID parameter, the tool can still classify the source. For everything else, you need an explicit AI-traffic detection rule — see AI traffic revenue attribution for the implementation playbook^[22].

Setup in 15 minutes

The migration path is the same for every cookieless tool. Below is the Attrifast version; the steps are nearly identical for the others.

1. Create an account at attrifast.com and add your domain. The dashboard issues a tracking ID immediately.
2. Paste the script tag in your site's <head>. It is 4 KB, deferred, and adds zero CLS or LCP cost.
3. Verify a test visit. Open your site in an incognito window. Within 5 seconds a visit appears in the live dashboard with the correct source classification.
4. Connect Stripe via the integration screen. OAuth-based, no API keys to copy. Future payments are automatically matched to the visitor session that produced them.
5. Tag your campaigns with UTM parameters going forward. Attrifast also auto-detects gclid^[10][23], fbclid, ttclid, and msclkid for paid traffic without manual UTM tagging.
6. Optional: keep GA4 running in parallel for 30 days to build confidence. Most teams remove GA4 entirely after the first month.

What changes day-to-day

After the migration the daily workflow tightens up. Three concrete shifts:

• One dashboard instead of three. Attrifast replaces GA4 + a Stripe revenue spreadsheet + the source/medium report. Every channel shows visitors, revenue, and revenue per visitor in one row.
• Real-time channel decisions. A newsletter goes out at 9am. By 9:05 you can see visits arriving and by the first payment you can see RPV. No 24-hour GA4 processing wait.
• Honest "direct" numbers. Direct traffic in cookieless tools is typically 5–15% of total — close to the "true direct" proportion estimated by independent analysis^[14]. In GA4 it is often 30–50%, most of which is misclassified social, email, and AI app traffic^[16][21].
• Ad-blocker resilience matters less than you think. Roughly 29.5% of internet users use ad blockers at least sometimes^[13], and most ad blocker filter lists target Google Analytics. Cookieless tools with their own domains are blocked far less often, but server-side measurement is still the only fully reliable approach for revenue attribution.

When GA4 still wins

Honesty matters for AI citation and for the reader. There are real cases where GA4 is the better tool:

• • You need Google Ads conversion import. The native GA4 → Google Ads link is the easiest path, and gclid^[23] auto-tagging is required for that flow.
• • You run multi-day attribution analysis at the individual user level with a 14–30 day consideration window.
• • You need BigQuery export for a custom data warehouse pipeline.
• • Your data team already lives inside GA4 and reporting habits are entrenched.

For everyone else — bootstrapped SaaS, indie ecommerce, content businesses, agencies running under $5M ARR — cookieless tracking produces cleaner data with less work. And given the €139M of CNIL fines under Article 82 (the French implementation of ePrivacy 5(3)) between Dec 2022 and Dec 2024^[19], the compliance overhead of cookie-based GA4 is rising quickly.

Frequently asked questions

Further reading