# Count Honestly: Analytics Without the Banner By Suraj Mondem · Published 2026-11-08 · 8 min read Original: https://www.mondemsuraj.com/writing/count-honestly > Three parts on your side of the counter. Now mine: I run a site and I wanted to know who reads it. Here's what needs asking first, what a fair banner looks like, and how I count on this site without one. Part 3 ended with the counter turning around. For three parts, we stood on your side of it. A note that says "I was here." A daily code that forgets you at midnight. A fingerprint that doesn't. A cookie that follows you down the street. But I run a website too. On 7 October, I added a counter to this one. A 2 KB script, 2,040 bytes against a budget of 2,048, that tells me when someone opens a post and whether they read it. So I had to answer the question this series kept circling. If you want to know who reads your site, what's the honest way to count? This post is my answer, from the builder's side. What you should ask first, what a fair banner looks like, what you should tell people, and the choices I made on this site. I'm not a lawyer, and the rules change by country, so treat this as a map, not legal advice. ## Start with the question, not the tool Most sites start with a tool. Add the popular script, turn everything on, figure out what to do with it later. I started with one question. Do people read what I write? That question needs very little. Which post. How far they scrolled. How long they stayed. Where they came from, so I know if LinkedIn or Google sent them. It doesn't need your name, your other sites, or who you are tomorrow. That's the first rule, and it has a name: **data minimisation**. Collect what your question needs, and nothing else. Remember the ladder from part 1. Count, where from, what they did, who they are, what they see. My question lives on the first three steps. Everything above that is a different job, and it comes with a different price. ## What needs asking first Here's the rule of thumb in Europe, where it's strictest. If your site stores something on a visitor's device, or reads something from it, you generally need their permission first. That's the rule behind every cookie banner. It comes from the **ePrivacy Directive**, and in 2024 Europe's data protection board made clear it isn't only about cookies. Tracking pixels, tracking links and fingerprinting can need consent too. There are exceptions. Things the site can't work without, like a sign-in or a cart, don't need asking. And France's regulator, the CNIL, lets a site skip the banner for basic audience measurement if it follows strict conditions. The counting has to be only for that site, no sharing, no tracking across other sites, cookies that last at most 13 months, data kept at most 25 months, and visitors told about it. The US is different. There's no single cookie-banner law. But some states give people the right to say no, and expect sites to listen. In 2022, California's attorney general settled with Sephora for $1.2 million, in the first public case under its privacy law. Part of the problem: Sephora ignored opt-out signals that browsers sent on people's behalf. > **Interactive: Does your site need to ask first?.** Tick what a site does: sign-in or a cart, counting visits while storing nothing, a first-party visit-counting cookie, ad or profile cookies, reading device details to recognise people, or another company's pixel. Ad cookies, fingerprints and pixels mean asking first. A first-party counting cookie may fall under an exception, like France's. Storage-free counting and necessary cookies need no banner, but people should still be told. A rough map of European rules, not legal advice. ## If you ask, ask fairly Say your site does need a banner. There's an honest way to ask and a dishonest one. The dishonest one is everywhere. A big bright "Accept all." A pale "Manage options" that opens three more screens. No "Reject all" on the first screen at all. It works, and that's the problem. In 2020, researchers tested different banner designs with people browsing real sites. Removing the reject button from the first screen raised consent by 22 to 23 percentage points. People didn't change their minds. The design changed them. A fair banner is boring on purpose. - "Reject all" is on the first screen, as easy to find and tap as "Accept all." - Nothing is switched on before you choose. - Each kind says what it's for in one plain line. - Saying no still lets you read the page. - Changing your mind later is one tap away. > **Interactive: Saying no on two banners.** Two made-up cookie banners. On the pushy one, saying no takes four taps: Manage options, turn off the pre-ticked Statistics and Marketing switches, then Save choices. On the fair one, with Accept all and Reject all side by side and nothing switched on, it takes one. ## Tell people, in plain words Asking is one part. Telling is the other, and it applies even when you don't need a banner. Most privacy policies are written for lawyers. They say "we may collect certain information" and never say what. A reader can't tell if that means "which page you opened" or "everything you've ever done." The honest version is a list. What you record, what you never record, who handles it, and how someone can ask you to delete it. My privacy page does this in one short screen. It lists the page you viewed and where you came from. Your country, from the request. A rough device and browser, like "Mobile, Safari, iOS." How far you scrolled and how long you stayed. And it says plainly what isn't there: no cookies, no IP address sent to the counting service, nothing tracked across days. If you can't write that list for your own site, that's the finding. You don't know what you're collecting yet. ## Listen when browsers say no Some people have already answered your question before they arrive. Browsers can send a signal on their behalf. **Global Privacy Control** is the newer one. Brave sends it by default, Firefox has a setting for it, and it's the one California expects sites to respect. **Do Not Track** is the older one, which most sites ignored. On this site, if your browser sends either, my script doesn't send anything at all. Not a smaller note. No note. There's also a switch for anyone who wants it: open any page with `?notrack` and that browser is never counted again. > **Interactive: What your browser told this site.** Whether your browser sends Global Privacy Control or Do Not Track, and whether you switched this site off with ?notrack, read from your browser when the box loads. If any is on, this site's counter sends nothing at all; otherwise it counts one view with no cookie and no IP address. Links switch counting off or back on in this browser. ## Keep less, and blur what you keep The last part is what happens after a visit is counted. Even honest counting collects more than it needs if you're not careful. Here's what I did on this site, step by step. - **No IP address.** Your address never reaches the counting service. My server replaces it with a scrambled stand-in, keyed with a secret only the server has. It's used to tell visitors apart within one day, then thrown away. - **Coarse buckets.** "Chrome on Android," never "Chrome 131 on a Pixel 8." Exact versions are part of what makes a fingerprint. - **Country, not city.** Enough to know where readers are. Not enough to know where you are. - **Clean links.** Web addresses lose everything after the `?`, except the campaign tags I add myself. Those leftovers can carry email addresses and session IDs. - **No bots, no previews.** Crawlers and test runs are dropped before they're counted, so the numbers mean people. None of these made the counter worse at its job. I still know which posts get read to the end. I just don't know who read them. That was the point. > **Interactive: My counter, against the checklist.** Nine checks, all met: collects only what its question needs, stores nothing on your device, says what it collects, honours GPC and Do Not Track, never sends your IP address, blurs device details, cleans links, drops bots and test runs, and never joins visits across days or sites. ## A checklist for anyone who counts - Write down the one question your analytics should answer. Collect only what it needs. - If you store or read anything on a visitor's device for tracking, ask first, and make "no" as easy as "yes." - Prefer counting that stores nothing on the device. Then you may not need a banner at all. - Publish a plain list of what you collect and what you don't. - Honour Global Privacy Control and Do Not Track. Give people an off switch. - Drop the IP address, blur device details, strip links, filter out bots. - Never join visits across days or across sites unless people have said yes. ## What to remember from part 4 - Start from your question, not your tool. Data minimisation is the whole first step. - In Europe, storing or reading something on a device usually needs consent, and that covers pixels and fingerprints too. - A banner where "no" is hidden isn't really asking. - Say what you collect, in a list a reader can check. - When a browser says no, listen. Count what you need. Say what you count. Stop where counting turns into knowing. ## They still have to find you So now I can count honestly. A reader opens a post, my counter notes the page, how far they read, and where they came from. And most of the time, "where they came from" says the same few things: LinkedIn, Google, or nothing at all. Which raises the last question of this series. How did they find the post in the first place? How does Google decide what to show, and now that people ask ChatGPT instead of searching, how does an answer engine decide what to quote? That's the next series.