How visits are counted without cookies

Insights Orbit counts visits without cookies, without storing anything in the visitor's browser and without keeping personal data. The one thing a browser keeps is a visitor's own choice not to be counted: when they ask for it, their browser keeps that choice for your website, so it can be honoured.

Recognising a visitor for one day

When a page is opened, the browser sends its address on the internet and a description of itself. Insights Orbit mixes these with the site and a secret that changes every night at midnight in the site's time zone, and keeps only the result. The same person on the same day gives the same result, so they are counted once. The next day the secret is new, so nobody can be followed from one day to the next.

The address and the browser's description are used for a moment to find the country, region and device, then dropped. They are never written down. The script also sends the window's width and the browser's language: only the screen size group, such as laptop-sized, and the main language, such as English, are kept.

Visits

A visit starts with the first page and ends after 30 minutes without activity. A visit's source, place, language and device come from its first page.

What is not counted

• Browsers with Do Not Track or Global Privacy Control switched on.
• Bots, such as search engine crawlers.
• Referrer spam: requests that pretend to come from a website to advertise it.
• Data centres and hosting networks, unless you switch that off in the site's settings.
• Addresses you leave out in the site's settings, such as your office.
• Browsers that opted out, or that your team marked as its own.
• Visitors whose ad blocker blocks the script.

Insights Orbit says how many visits it left out on purpose, beside the overview.

Do you need a consent banner?

We don't think so for anonymous counting, but the law isn't settled, so check it with your own advisers. The facts they need:

• What the script reads: The page address, the page that linked to it, the window's width and the browser's language. It also checks Do Not Track, Global Privacy Control and the visitor's own opt-out, so it can respect them.
• What it stores in the browser: Nothing, unless the visitor asks not to be counted.
• What is kept: The daily visitor hash, the page without its query, the referring site, campaign tags, country, region, device, browser, system, screen-size group and main language. Nothing that can be linked to a person or from one day to the next.

The ePrivacy rules (in Germany, § 25 TDDDG) ask for consent before storing or reading information on a visitor's device, unless it is strictly necessary for a service the visitor asked for. Insights Orbit stores nothing, but its script reads a little, and German regulators see visit counting as generally not strictly necessary. Other regulators, such as France's CNIL, let audience measurement run without consent when it is first-party, aggregated and limited in time, as Insights Orbit is. Many websites in Europe use cookieless analytics without a banner on that basis.

If you decide to ask for consent, Insights Orbit can wait for it: the script then reads and sends nothing until your consent banner says the visitor agreed. Your developer adds one attribute, described in The script.

Whatever you decide, mention Insights Orbit in your privacy notice: what is counted, why, and how visitors can opt out. Site settings has an opt-out page you can link to. See What to write in your privacy notice.

Known users

A website where people sign in can send its own user id, so Insights Orbit can follow the same person across days and devices. That is personal data, so it is off unless an admin switches it on, and it comes with the Enterprise plan.