Running a website without cookies or trackers
A website without cookies sets nothing in the visitor's browser for tracking, advertising or analytics, and loads no third-party trackers. Anticode's published design-engine pages run no scripts at all and its analytics count page views without cookies. That removes the most common reasons for a consent banner, but not every obligation: forms, outside images and your own setup still need a look.
Where cookies on a small site usually come from
Most small sites don't set cookies on purpose. They arrive with the tools added along the way, and each one can bring others with it.
| Source | What it does | Cookie-free alternative |
|---|---|---|
| Analytics scripts | Track visitors across pages and visits | Server-side counting without identifiers |
| Advertising pixels | Follow visitors for retargeting | Leave them out, or accept you need consent |
| Embedded video and maps | Load the provider's player, often with its cookies | A link or a still image that opens the video or map |
| Chat widgets | Remember the conversation and visitor | A contact form or an email address |
| Social share buttons | Load scripts from each network | Plain links |
| Site builder's own scripts | Sessions, A/B tests, editing tools | A builder whose published pages carry no scripts |
What Anticode's published pages do
Pages laid out by Anticode's design engine are plain HTML and CSS with no scripts at all; their Content-Security-Policy refuses scripts and frames. So there's nothing on the page that could set an analytics or advertising cookie, and no embeds that would load someone else's. No third-party trackers are added to published pages.
Visits are still counted. The dashboard shows page views per site per day, by source, counted without cookies, including referrals from AI assistants, with AI and search crawlers counted separately. That answers the questions most small sites have (is anyone visiting, and from where?) without following anyone. The traffic without cookies guide explains what this kind of counting can and can't tell you.
Requests that still leave the page
A cookie free website isn't automatically one that makes no outside requests, and a privacy review should list them.
- Photos from the curated library load from images.unsplash.com, so the visitor's browser contacts that server. To call no one else, leave photos out or build the site as an app, which shows photos you upload from your project; design-engine pages don't use uploads, and a hosted address in a CMS image field calls that host instead.
- App builds such as calculators and games can load fonts from Google Fonts, the one outside source the app sandbox allows, and can save to the visitor's own browser storage (localStorage). Storage on the visitor's device can fall under the same rules as cookies in some places, depending on what's stored and why.
- Payment links take visitors to your provider's checkout, which sets its own cookies under its own policy once they click.
Do you still need a banner or a policy?
Under the EU and UK rules on cookies and similar technologies, consent is generally needed for storage on a visitor's device that isn't strictly necessary for the service they asked for. A website without tracking of that kind often doesn't need a consent banner at all. But laws differ by country, apps that use browser storage need thinking about, and only you know every tool you've added. Read do I need a cookie banner and check your own position; this page isn't legal advice.
A privacy policy is a separate question from cookies. If your site collects anything through a form, such as names and emails, you still need to tell people what you collect, why and for how long. Each Anticode site gets a Privacy Policy and Terms written from what that site actually does. They're a starting point to read and adjust, not legal advice. Form submissions are sealed at rest, and the dashboard keeps an access log of the last 200 reads, exports and deletes of form data.
Limits worth knowing
- No third-party analytics built in. If you need Google Analytics-style funnels or heatmaps, Anticode doesn't provide them, and adding them would mean scripts the published pages don't allow.
- No consent banner tool. Because pages run no scripts, there's nothing for one to control; if your situation needs one, the site isn't the right fit as it stands.
- Connectors send form data onward. Sending submissions to HubSpot, Mailchimp or Google Sheets shares them with those services; mention them in your privacy policy.
- Your checkout provider's cookies are outside Anticode's control once a visitor leaves the page.
Questions people ask
Can a website really work without cookies?
Yes. Most informational sites, portfolios and small business pages need none. Cookies become necessary mainly for logins, carts and tracking.
How do I know how many people visit without cookies?
Server-side counting records each page view without identifying the visitor. You get daily totals and sources, not individual journeys.
Is a privacy friendly website the same as a GDPR-compliant one?
No. Avoiding tracking helps a lot, but compliance also covers forms, retention, who can read data and what your policy says. The GDPR checklist covers the rest.