Cookie, cookieless or consent first

01Three ways to count

Each site's mode is chosen when you add it, and its snippet carries it as data-mode (cookie mode, the default, needs none). The site's Setup page says what its mode shows.

02What each shows, and can't

Cookie mode

• Visitors, pages, sources, countries and devices.
• Returning visitors, recognised across days for a year.
• The source that first brought each visitor, even when they come back another way.

Cookieless mode

• Visitors per day, pages, sources, countries and devices.
• No cookie is set, so there's nothing for a cookie banner to cover.

Consent first mode

• Everything cookieless mode shows, for every visitor.
• Returning visitors, from the visit on which they consent.

03Consent mode and your banner

A consent-first site counts every visitor as cookieless mode does, until your banner calls tally('consent', true). From then on that visitor has a first-party cookie and is recognised across days. A no, or consent taken back, is tally('consent', false), which deletes the cookies:

window.tally = window.tally || function () { (tally.q = tally.q || []).push(arguments); };

// When your banner gets a yes:
tally('consent', true);

// When the visitor says no, or takes it back:
tally('consent', false);

The consent itself is kept in a cookie of its own, _tally_c, which only that call writes. Call it from your consent tool's callback for analytics, on every page where the banner can answer.

04Whichever mode you choose

• The visitor's IP address is used to find their city, then dropped. It's never stored, logged or written to disk.
• Cookieless counting uses a hash of the IP address and the browser, with a salt that changes every day and is then deleted, so nobody can be followed from one day to the next. The hash is kept; the address never is.
• Visitor ids never appear in logs.
• An email sent with identify is hashed when it arrives; only the hash is kept.

The privacy notice says what is kept, for how long and who processes it, and the data processing agreement covers your visitors' data.

05Leaving your own visits out

To leave your own browser out, open your site, then the browser's console, and run:

localStorage.setItem('datafast_ignore', 'true');

The script then sends nothing from that browser. localStorage.removeItem('datafast_ignore') counts it again. (The name is DataFast's, so a browser already left out stays out.)

On WordPress, the plugin can leave out logged-in admins instead.