Become an affiliateStart your program

Technology and tracking

Cookieless tracking

Also called cookie-free tracking, cookieless attribution, URL-based tracking, click ID tracking.

Short answer

Cookieless tracking is measuring affiliate referrals without a cookie in the user's browser. Instead, the click ID is carried in the URL and matched on the server at conversion. Fingerprinting is also counted as cookieless, but it is a far more intrusive method.

Definition of Cookieless tracking.

Cookieless tracking lumps two completely different approaches under one name. The deterministic one relies on a click ID that travels in the URL, is stored by the store alongside the order and is sent back server-to-server. The probabilistic one tries to recognise the user from device signals – screen size, fonts, language, IP address – without storing anything.

The need arose when browsers tightened up. Safari blocks third-party cookies and cuts the lifetime of first-party cookies set with JavaScript to 7 days, Firefox blocks known third-party tracking by default, and ad blockers strip out both scripts and cookies. Measurement that relies solely on the cookie therefore loses a growing share of its conversions.

The two approaches are not equal. A click ID in the URL is precise, explainable and easy to audit: there is a click record, an order and a key that ties them together. Fingerprinting is a guess, cannot be shown to the user, and under the ePrivacy rules counts as reading information on the user's device – meaning it requires consent just like cookies.

What cookieless does not mean

Cookieless does not mean anonymous. A click ID that can be linked to an order, an amount and an IP address is information about a person, whether it sits in a cookie or in a URL. The rules on consent and the duty to inform do not disappear because the storage location moves.

Cookieless does not mean cross-device either. If the customer clicks on their phone and buys on their computer, there is no shared key between the two devices unless you start linking profiles together. That is an entirely different and far more far-reaching decision than moving an ID from a cookie to a URL.

The URL parameter is the weak link

If the click ID is carried in the link, measurement stands or falls with the parameter surviving the journey. It can be lost in a redirect that does not pass on the query string, in a checkout on another domain, in a link the user copies and shares without the parameter, or in a consent tool that reloads the page.

That is why the two are combined in practice: the parameter captures the click, a first-party cookie on the store's own domain holds on to it during the visit, and the server finally decides whether the click is still within the window. Calling that setup cookieless is a stretch.

How it goes wrong

  • 01

    Cookieless sold as a cure-all

    Moving from cookie to URL solves the lifetime problem, not the tracking problem. Users who switch devices, block scripts or land without the parameter still disappear from the measurement.

  • 02

    Fingerprinting seen as a legal loophole

    Because nothing is stored on the device, many people think the rules do not apply. Reading the device's characteristics is covered in the same way as storage and must be treated as requiring consent.

  • 03

    Switching method without comparing the figures

    If a program moves from cookie to click ID in the middle of a period, both the volume and the distribution change. Run the two methods side by side for at least a month before discarding the old series.

At Affilyflow

Cookieless tracking in practice

Affilyflow uses a click ID carried in the link and a cookie on the store's domain – and we do not call it cookieless, because the cookie is still part of the chain. There is no fingerprinting, no identity graph and no recognition across devices. That is a deliberate choice, not a gap to be closed.

What sits on the server, on the other hand, is locked. The click's timestamp, commission rate, commission type and attribution window are written to the click record at the very moment of the click, and the window is decided by our server, not by the browser. Every tracking event is logged, including those that did not become a sale.

Frequently asked questions

Does affiliate tracking work without cookies?

Partly. If the click ID is carried in the URL and matched on the server at conversion, a sale can be recorded without a cookie. But the parameter has to survive all the way to the purchase, and if it does not, the click cannot be found at the time of the order.

Is cookieless tracking legal without consent?

Not automatically. The rules cover both storing information on and reading it from the user's device, so fingerprinting requires consent just like cookies. The assessment depends on which data is processed and for what purpose.

What is the difference between cookieless tracking and server-to-server tracking?

Server-to-server tracking describes how the conversion is reported back: the store's server calls the network's server. Cookieless tracking describes how the click is identified along the way. The two are often used together, but they are not the same thing.

Does fingerprinting replace the third-party cookie?

Technically it can look like a replacement, but it is a probabilistic guess, it cannot be explained to the user, and it is subject to the same consent requirements. Deterministic click IDs are both more precise and easier to stand behind.

Read on