← All guides

Fathom Analytics: cookieless, but with short-term IP processing

Prerequisites

Access to the Fathom integration and clarity on whether external analytics processing is required for the purpose.

Fathom is cookieless, but this does not mean no personal processing: The provider documents the processing of the IP address and user agent for site-specific signatures with daily rotating salt. For “We don’t save!” transparently name this processing and the external service.

Check

After the change, check browser memory, network connections and web server, proxy and application logs separately. A product setting does not automatically prove that no visitor IP is stored at all levels.

Basics of visitor recognition

For classification purposes, Cookieless is not automatically tracking-free and Use unique visitors without recognition . What is important is not just the presence of cookies, but also whether requests are merged via sessions, hashes, local storage or other features.

Dismantling

If additional analysis functions are required, just reactivate these specifically and check the resulting recognition or IP processing again.

Related guides

• Plausible: Understanding IP processing and daily visitor recognition
• Pirsch: cookieless with daily visitor ID from IP and user agent
• Umami: cookieless does not mean without visitor identification
• WordPress: Classify independent analytics in a data protection-conscious manner

Sources and verification

This guide is based on multiple current sources. Vendor documentation is not treated as proof that every concrete installation automatically follows the same privacy characteristics.

• Documentation 1
• Documentation 2

Important: IP processing is not IP storage

An IP address has to be processed to establish and deliver a network connection. Hosting providers, firewalls or DDoS protection may also process or retain it for a limited time for security purposes. No Logging distinguishes this security layer from unnecessary persistent visitor logging by the website, application and ordinary access logs.