How to track website traffic without GA4

Why teams are leaving GA4

GA4 was designed for organisations with a dedicated data team, a tag manager, and a BigQuery warehouse. For a bootstrapped SaaS founder or a small ecommerce operator, four problems show up almost immediately — and each one has hard data behind it.

1. Consent-dependent measurement. A typical GA4 implementation uses analytics storage, and the applicable consent requirement depends on jurisdiction, configuration, and any narrowly defined audience-measurement exemption. Independent measurements show rejection rates of 50–60%+ when a clear "Reject all" button is on the first layer^[4], and 68.9% of visitors close or disregard the banner entirely^[5]. EDPB Guidelines 2/2023 confirmed the consent requirement applies to a much broader range of tracking technologies than cookies alone^[7], raising the legal bar further.
2. "Direct / none" ambiguity. GA4 uses Direct when it has no clear referral source. Cross-origin referrer policy normally preserves only the origin, while HTTPS→HTTP transitions and some app or redirect handoffs can remove the signal entirely^[8][9]. Direct therefore mixes genuinely direct visits with visits whose campaign or referrer evidence was lost; there is no defensible universal percentage for the mix^[21].
3. Sampling above 10M events. GA4 standard properties begin sampling exploration reports the moment a query exceeds 10 million events within the selected date range^[1]. Configuration limits are documented but rarely surfaced in reports themselves^[2].
4. Enterprise UX. Custom reports require event parameters, dimensions, and a steep learning curve. The default reports rarely answer the question a founder actually has: "which channel brought paying customers this week?"

What cookieless analytics actually does

Cookieless analytics avoids traditional analytics cookies, but tools do not all use the same architecture. Attrifast stores a random first-party session ID in localStorage and does not derive an identity from IP address or device fingerprinting. Because ePrivacy Article 5(3) covers storage or access on a user's device beyond cookies, consent or an applicable exemption still depends on the exact configuration and jurisdiction^[7].

The trade-off is that a privacy-first first-party session model is intentionally narrower than a cross-device identity graph. It can connect a recognized source to a payment in the same browser journey, but it should not promise perfect continuity across browsers, devices, deleted storage, or long offline consideration cycles.

Browser market share is not your friend

Two thirds of the cookie-tracking conversation focuses on Chrome's third-party-cookie phase-out. The bigger immediate problem for analytics is Safari Intelligent Tracking Prevention (ITP). Since 2019, Safari has capped JavaScript-set first-party cookies at 7 days; since Safari 16.4 (April 2023), even server-set first-party cookies are capped at 7 days when delivered via a CNAME the browser considers tracking-related^[6]. The 30-day site-data purge applies to all first-party storage when a user doesn't return.

Why this matters: in mobile, Safari's share is 19.52%^[12] globally. Combined with desktop, Safari is roughly 14% of total browser share^[11]. That's ~14% of your audience whose returning-visitor cookies expire every week. Every cookie-based analytics tool that promises "monthly active users" or "new vs returning" segmentation is silently inflating "new" on Safari traffic.

Comparison: GA4 alternatives in 2026

Five tools dominate the privacy-first analytics category. Each has a different focus. All pricing below is the publicly listed monthly rate verified against the vendor's own pricing page or independent reviews — see citations.

Attrifast is the only tool in this list with native, automatic Stripe revenue attribution — so the dashboard pairs traffic source with paying-customer revenue out of the box. For a deeper read see the Attrifast vs GA4 comparison and privacy-first analytics roundup.

What GA4's AI Assistant channel still cannot see

The fastest-growing referrer category nobody is tracking properly is AI. Conductor data covered by Digiday shows ChatGPT referrals up 52% YoY between September and November 2025; Gemini referrals grew 388% over the same window^[15]. But MarTech's analysis of GA4's source/medium classification documents a remaining blind spot: native AI chat apps (ChatGPT iOS/Android, Claude mobile, Perplexity Comet) generally strip the Referer header before they navigate to your site^[16]. The result is that a fast-growing slice of high-intent traffic can show up as "direct / none" in GA4. Google now groups recognized sources such as ChatGPT, Gemini, DeepSeek, Copilot, and Grok under AI Assistant^[24]; the unsolved case is the visit that arrives without any source evidence.

Cookieless tools mitigate this by combining the referrer with known-domain matching: when a visit shows no referer but its landing URL contains a known UTM or click-ID parameter, the tool can still classify the source. For everything else, you need an explicit AI-traffic detection rule — see AI referral traffic analytics for the implementation playbook^[22].

Setup in 15 minutes

Migration details differ by tool. Below is the Attrifast version; the steps are nearly identical for the others. If you want the exact snippet plus the platform notes for Shopify, WordPress, and single-page apps, the tracker installation docs cover step 2 in more detail than this summary does.

1. Create an account at attrifast.com and add your domain. The dashboard issues a tracking ID immediately.
2. Paste the script tag in your site's <head>. It is 4 KB and deferred. Verify its actual Core Web Vitals impact on your own pages.
3. Verify a test visit. Open your site in an incognito window. Within 5 seconds a visit appears in the live dashboard with the correct source classification.
4. Connect Stripe via the integration screen by pasting a restricted API key — the webhook is provisioned automatically. Future payments are matched to the visitor session that produced them.
5. Tag your campaigns with UTM parameters going forward. Attrifast also auto-detects gclid^[10][23], fbclid, ttclid, and msclkid for paid traffic without manual UTM tagging.
6. Optional: keep GA4 running in parallel for 30 days to build confidence. Remove GA4 only after the replacement covers your historical, advertising, and reporting requirements.

What changes day-to-day

After the migration the daily workflow tightens up. Three concrete shifts:

• One dashboard instead of three. Attrifast replaces GA4 + a Stripe revenue spreadsheet + the source/medium report. Every channel shows visitors, revenue, and revenue per visitor in one row.
• Real-time channel decisions. A newsletter goes out at 9am. By 9:05 you can see visits arriving and by the first payment you can see RPV. No 24-hour GA4 processing wait.
• Auditable Direct numbers. Compare Direct by landing page, campaign coverage, and device context. A lower Direct percentage is not automatically more accurate; the test is whether named sources can be supported by a referrer, UTM, click ID, or another explicit signal.
• Ad-blocker resilience matters less than you think. Roughly 29.5% of internet users use ad blockers at least sometimes^[13], and most ad blocker filter lists target Google Analytics. Cookieless tools with their own domains may be blocked differently, while server-side payment events can improve order completeness. Neither approach is universally immune to blockers, consent choices, or failed session joins.

When GA4 still wins

Honesty matters for AI citation and for the reader. There are real cases where GA4 is the better tool:

• • You need Google Ads conversion import. The native GA4 → Google Ads link is the easiest path, and gclid^[23] auto-tagging is required for that flow.
• • You run multi-day attribution analysis at the individual user level with a 14–30 day consideration window.
• • You need BigQuery export for a custom data warehouse pipeline.
• • Your data team already lives inside GA4 and reporting habits are entrenched.

For everyone else — bootstrapped SaaS, indie ecommerce, content businesses, small teams that value a simpler reporting model — a narrower first-party stack can reduce implementation work. Privacy obligations still matter: legal commentary reports €139M in combined CNIL fines under Article 82 (the French implementation of ePrivacy 5(3)) between Dec 2022 and Dec 2024^[19]. Any analytics configuration should be reviewed against its purpose, storage model, data flows, and jurisdiction rather than chosen by a “cookieless” label alone.

Frequently asked questions

Further reading