Cookieless tracking avoids persistent analytics identifiers in the browser. One server-side pattern hashes an IP address and user agent with a secret salt that rotates daily. This supports approximate within-day deduplication while limiting cross-day linking. Country can be derived at request time and stored as an aggregate dimension without retaining the IP address itself. The design is useful for totals, daily trends, and rough unique counts, but it cannot reliably connect one visitor's activity across multiple days or devices. Bot filtering and a documented salt-rotation schedule are still necessary for meaningful numbers. The raw inputs should not be retained, and the hash should not be reused for advertising or account profiling. The resulting hash is pseudonymised data rather than automatically anonymous data, so lawful basis and consent requirements still depend on the purpose, implementation, other technology, and jurisdiction. A destination page can also introduce separate cookies or embeds even when the shortener does not. Review the whole data flow rather than treating cookieless as a compliance label.