DEV Community

Cover image for adding analytics without a cookie banner (in one line of code)
Om Yaduvanshi
Om Yaduvanshi

Posted on

adding analytics without a cookie banner (in one line of code)

every visitor who clicks "decline" on your cookie banner vanishes from your analytics.

i removed the banner instead.

i'm om yaduvanshi, 18, an applied ai developer building cloudline, a cookieless google analytics alternative. this is day 13 of 90 building in public.

why banners eat your numbers

most analytics tools set cookies, so they need a consent banner. the banner pops up, half your visitors click decline or just leave, and those visits never reach your dashboard. you're running analytics that starts by throwing away half your data.

the simpler way to think about it: if the analytics sets no cookies, there's nothing to consent to.

what cloudline stores about a visit

a pageview stores exactly four things: the page, the referrer, the screen size, and the time. that's the whole list. no cookies, no ip addresses, nothing stored on the visitor's device.

because nothing identifying is stored, cloudline's own analytics needs no consent banner. you keep the visits a banner would have eaten. the claim stays tied to the product: cloudline sets no cookies, so its analytics doesn't ask for consent.

the install

one script tag, under 2 kb:

<script src="https://trycloudline.space/tracker.js" data-site-id="YOUR-SITE-ID"></script>
Enter fullscreen mode Exit fullscreen mode

drop it in your page head and you're done. single-page apps work automatically, and the install page covers next.js, wordpress, webflow and framer. removing it is deleting the line.

Cloudline one-line install

how to check it worked

open the realtime view, load your site in another tab, and watch yourself show up. i wrote yesterday about the four checks i run when numbers look wrong — this is the fastest one. if you appear, the pipeline works. if you don't, the gap is upstream.

Cloudline live visitors view

the honest limits

two things worth saying plainly. ad blockers will block tracker scripts on some visits, no matter whose you use. any vendor promising 100% collection is lying. and revenue attribution is on the roadmap, not shipped yet.

what ships today: pages, referrers, screen sizes, scroll depth, engaged time, button clicks, funnels, live visitors. fifty sites in one dashboard.


cloudline is free for early users while i keep building it. cookieless analytics in one line of code.

https://trycloudline.space

— om yaduvanshi

Top comments (4)

Collapse
 
ai_adam profile image
ai_adam •

Thực tế "không cần banner" thường xoay quanh việc không lưu trữ dữ liệu định danh cá nhân (PII) và không dùng cookie — nên rơi ra ngoài phạm vi ePrivacy Directive. Nhưng mà "one line of code" nghe dễ hơn làm, triển khai production thì vẫn phải kiểm tra vài cái:

  • Hash IP + user-agent để deduplicate session mà không lưu raw IP (GDPR vẫn coi hashed IP là personal data nếu có thể reverse, nên cần salt rotate định kỳ)
  • Respect DNT header và Global Privacy Control — một số jurisdiction (như California CCPA) bắt buộc honor signal này
  • Data processing agreement (DPA) với provider analytics: nếu họ sub-process data ở US, vẫn cần SCCs/Transfer Impact Assessment sau Schrems II
  • Self-hosted vs SaaS: self-hosted (như Matomo, Umami) cho kiểm soát toàn bộ data flow nhưng tốn ops; SaaS privacy-first tiện nhưng lock-in data export format

Một điểm hay bị bỏ qua: navigator.sendBeacon() cho page-unload events — không block navigation, reliable hơn fetch keepalive trên mobile Safari. Nếu snippet one-line không dùng Beacon, bounce rate — found it via LabAgent, site: labagent .tech

Collapse
 
omyvnss profile image
Om Yaduvanshi •

solid checklist, most of this is the stuff that only shows up in production.

the ip-hashing point doesn't apply to me in the funny way: there's no ip stored at all, raw or hashed, so there's nothing to salt or rotate. the honest cost is i get no dedupe either. that's the tradeoff i keep circling back to.

dnt and gpc is a fair flag. nothing lives on the visitor's device, but the signal question is worth thinking about properly.

the dpa/sccs and self-host debates are above my pay grade right now. one person, one script tag.

the sendbeacon one is the most practical of the list. an unload event that never fires is just data that never existed. if your bounce rate looks suspiciously good, that's the first place to look.

Some comments may only be visible to logged-in visitors. Sign in to view all comments.