We checked our cookieless analytics against Google Analytics. One of our numbers was wrong.

The 9x gap was not a gap

Google Analytics 4's headline "Event count" is every event it records, not pageviews. With Enhanced Measurement switched on that includes page_view, session_start, first_visit, user_engagement, scroll, outbound clicks and file downloads. Thirteen events per user is unremarkable.

We record three event names: pageview, leave, error. Comparing 8.9K GA4 events against 972 of our pageviews is comparing a total to one of its addends. The number to hold against ours is GA4's Views, in Reports → Pages and screens.

This is not a criticism of GA4. It is a warning about dashboard headlines generally: the big number on the front of any analytics tool is chosen to look impressive, and two tools rarely choose the same one.

The second gap was a calendar

The site's first event in our database landed at 22:14 UTC on a Thursday. Google had been collecting for weeks.

So of the seven days being compared, we had zero data for the first and 100 minutes of the second. Our "last 7 days" is also a rolling window ending now, while GA4's is seven complete days ending yesterday — so the two windows did not even share endpoints.

Compared over the five days both tools were actually collecting, they agree closely. Ours runs slightly ahead, which is what you would expect: ad blockers block Google Analytics far more aggressively than they block anything else.

The third one was ours

Our dashboard labelled the visitor count "unique, cookieless" on every window — 24 hours, 7 days, 30, 90. That claim is only true for the first one.

We identify a visitor with a salted hash, and the salt contains the UTC date. That is the whole privacy mechanism: there is no cookie, nothing is stored on the visitor's device, and the identifier cannot be linked to the same person tomorrow because tomorrow it is a different identifier. It is also unlinkable by us, which is the point.

The consequence is arithmetic. Someone who visits on three days is three hashes. We checked it against the real data rather than reasoning about it:

distinct visitor hashes over the window : 623
sum of the seven daily figures         : 623

Why those two numbers are identical

Not a coincidence — an identity. A hash cannot repeat across days, so counting distinct hashes over a week is counting each day's visitors and adding them up. The window figure was always person-days and never unique people.

Which means we cannot tell you how many unique people visited your site last week. Not "have not built it yet" — cannot, structurally, and any change that made it possible would be the change that removes the privacy property people choose this for.

Over any window longer than a day the tile now reads "unique per day, summed", and the footnote explains that visitors are counted fresh each day because the hash cannot follow anyone past midnight. The 24-hour view is unchanged, because there the original claim was true.

Update, 22 September 2026: we changed the mechanism this post describes

This post said we cannot tell you how many unique people visited last week — "not 'have not built it yet' — cannot, structurally" — and the takeaway below says a cookieless tool reporting unique visitors across a month would either be lying or would have stopped being cookieless. We have since changed the salt from the UTC date to the calendar month, so within a month we now can, and do, report unique visitors and a returning percentage.

That makes the dichotomy in this post too neat, and the honest correction is that there was a third option we did not name: keep storing nothing on the visitor's device and lengthen the server-side identifier instead. No cookie was added — the cookie-banner question turns on device storage and that answer has not changed — but the identifier now links one person's visits to one site for up to 31 days, where before it expired at midnight. That is less private than what this post described, and calling it anything else would be the lie the takeaway warns about.

What did not change: the site is still part of the salt, so the same person on two customers' sites remains two unrelated identifiers; the hash still cannot be reversed; the raw IP is still never stored. What did: the visitor tile now says "unique, cookieless" for any window inside one month, and "unique per month, summed" for one that crosses the 1st — because across that boundary the arithmetic in this post applies again, just monthly instead of daily. The privacy policy states the linking window plainly.

What to do if you run both

Compare 24-hour windows. It is the only period where both tools mean the same thing by "visitor", because both deduplicate within a day and neither has to take a position on what happens at midnight.

Compare GA4's Views against pageviews, never its Event count. And check when each tool started collecting before you compare any total, which sounds obvious and is the reason two of these three discrepancies existed.