← All guides

PostHog: Correctly classify cookieless mode

Requirements

Access to the PostHog project configuration and clarity as to whether Unique Users or Person Profiles are even needed.

In Cookieless server hash mode, PostHog does not store any identifiers in cookie, local storage or session storage. For unique users, a daily changing hash of team ID, salt, IP, user agent and host name is generated on the server side. identify() and person profiles should be avoided if permanent personal identification is not desired.

Check

After the change, check browser memory, network connections and web server, proxy and application logs separately. A product setting does not automatically prove that no visitor IP is stored at all levels.

Basics of visitor recognition

For classification purposes, Cookieless is not automatically tracking-free and Use unique visitors without recognition . What is important is not just the presence of cookies, but also whether requests are merged via sessions, hashes, local storage or other features.

Dismantling

If the reduced measurement is not sufficient, restore the previous PostHog configuration and re-evaluate visitor recognition, storage mechanisms and retention.

Related guides

• Plausible: Understanding IP processing and daily visitor recognition
• GoatCounter: Correctly classify sessions, IP processing and aggregates
• Fathom Analytics: cookieless, but with short-term IP processing
• Pirsch: cookieless with daily visitor ID from IP and user agent

Sources and verification

This guide is based on multiple current sources. Vendor documentation is not treated as proof that every concrete installation automatically follows the same privacy characteristics.

• Documentation 1
• Documentation 2

Important: IP processing is not IP storage

An IP address has to be processed to establish and deliver a network connection. Hosting providers, firewalls or DDoS protection may also process or retain it for a limited time for security purposes. No Logging distinguishes this security layer from unnecessary persistent visitor logging by the website, application and ordinary access logs.