Why your analytics counts one visitor as three people

The first bug report a founder files against their own analytics is nearly always the same one. They open their site to check a change, refresh a few times, open a second tab to compare the old version, and the live view says four people are on the site. There are not four people on the site. There is one person, mildly annoyed.

Nothing is broken. What is happening is that *visitor* is not a thing that exists out in the world waiting to be measured. It is a definition somebody wrote down, and different tools wrote down different ones.

Three ways analytics tools identify a visitor

Every analytics tool has to answer one question before it can count anything: is this request the same person as that request? There are only three families of answer in common use.

1. Write an identifier to the browser

The classic approach. On the first visit the tool generates a random identifier, stores it in a cookie, and every later visit sends it back. It is the most accurate method available for recognising a returning visitor, and it is why Google Analytics can tell you about somebody who came back six weeks later.

It is also the method that puts you inside Article 5(3) of the ePrivacy Directive and therefore behind a consent banner in the EU and UK, which is the subject of the cookie banner article. And its accuracy is softer than it looks. Cleared storage, a second device, a different browser and private windows all produce a brand new person.

2. Scope it to the tab

Some tools keep the session identifier in `sessionStorage`, which browsers scope to the tab rather than to the browser. This is the specific reason a founder with three tabs open shows up as a small traffic spike. Each tab has its own storage, so each tab is its own session, and depending on how the tool rolls sessions up, potentially its own visitor.

Find out whether your tool does this before you interpret a number, because it does not fail gracefully. Anyone comparison-shopping with several tabs of your pricing page open inflates your visitor count and deflates your pages-per-visit at the same time.

3. Work it out server-side and store nothing

The cookieless approach. The browser is given nothing to remember. The server takes what it already has, the IP address and the user-agent string, hashes them together with a secret salt, and uses the hash as the identifier. The IP itself is never stored and the hash cannot be reversed to recover it.

Because the identification happens on the server, the number of tabs is irrelevant. Three tabs produce three requests carrying the same IP and the same user-agent, so they resolve to one person. This is what DataSpice does. It is also what Plausible and Fathom do, so it is a property of the approach rather than a feature any of us invented.

Why sessions expire after thirty minutes of inactivity

Knowing who somebody is only gets you halfway. You also have to decide when their visit ended, and the answer nearly everyone uses is thirty minutes of inactivity.

There is no principle behind that number. It is a convention that hardened in the early web-analytics era and stuck around because everybody else was using it and comparability was worth more than precision. It has an obvious failure mode. A visitor who reads a long article for thirty-five minutes without clicking anything, then clicks, has just started a second session. Two sessions, one person, one continuous act of reading.

Tools that send periodic heartbeats while a page is visible avoid the worst of this, because the activity clock keeps getting reset by the page being open rather than by clicks. DataSpice uses a thirty-minute idle window with heartbeats, which is the common configuration.

What cookieless visitor counting costs you at midnight

Here is the part cookieless vendors, ourselves included, should say more loudly than we usually do.

If the salt used in that hash never changed, the identifier would be stable forever, which would make it a durable identifier for a person and defeat the whole point. So the salt rotates, typically once a day, and the old one is deleted. That deletion is the point. Once yesterday's salt is gone, yesterday's identifiers cannot be recomputed by anybody, including the vendor and including anybody who compels the vendor.

The cost lands on your numbers. A visitor who comes back on three consecutive days is three distinct visitors, because the identifier they produce is different each day. Weekly and monthly unique-visitor totals from a cookieless tool are therefore *higher* than the same population measured with a cookie, and the two are not comparable.

Six more reasons two analytics tools never agree

• Bot filtering. Every tool keeps its own list of crawlers and its own heuristics. A visit one tool throws away as automated is a visitor in another.
• Prefetching. Browsers and link-preview services fetch pages nobody looked at. Whether those become pageviews depends on the tool.
• Blockers. Script blockers hit well-known analytics domains far harder than obscure ones, so two tools on the same page lose different visitors.
• Consent gating. A tool behind a banner only sees the people who accepted. A tool that needs no banner sees everybody. On EU traffic that alone can be a large gap.
• Sampling. Some tools estimate above a volume threshold and suppress rows below one. Estimated numbers do not reconcile with counted ones, by construction.
• Time zones. "Today" in UTC and "today" in your reporting time zone are different days, and daily totals differ at the edges.

How to pick one visitor number and trust it

1. Pick one tool as the number of recordNot the highest one. The one whose definition you understand and could explain to somebody else. Reconciling two tools against each other is work that produces nothing.
2. Watch trends rather than totalsThe absolute count is a definition. The direction is a fact. A 40% rise week over week is real in any tool. The number it rose to only means something inside one.
3. Exclude yourselfYou are the most active user of your own site by a wide margin, and at low volumes your own refreshing is a visible fraction of the graph.
4. Write down what you meanOne line in your own notes: what a visitor means in the tool you picked, over what window. In six months, when a number looks wrong, that line is what stops you rebuilding this reasoning from scratch.

The goal is not a number that is correct in some absolute sense. No such number exists. The goal is a number that means the same thing this week as it did last week, so that when it moves you know something happened.

Plausible resolves visitors server-side too, which is why its numbers land closer to ours than to a tab-scoped tool's. DataSpice vs Plausible compares the two on counting and on everything else.