What Are Unique Visitors? How Counting Really Works

Unique visitors is the count of distinct people in a period — the metric everyone quotes and no tool measures perfectly, because 'distinct person' must be inferred from imperfect signals. How a tool does that inference is its real privacy policy.

The three counting methods

1. Cookie-based (classic GA): a persistent ID per browser. Accurate until cookies are cleared, blocked, or refused via consent — which now describes a third or more of traffic, so the 'accurate' method undercounts massively in practice.
2. Fingerprint-based: deriving an ID from device traits. Works without cookies; regulators increasingly treat it as tracking requiring consent — the approach ethical tools refuse.
3. Rotating-hash (cookieless): a daily-rotating salted hash groups a visitor's hits within a day, then forgets. No persistent identifier exists; a Tuesday visitor returning Friday counts as new.

Why numbers differ between tools

Each method has a different bias: cookie tools undercount via consent refusal and blocking; cookieless tools overcount return visitors across days. Add divergent bot filtering and you should expect ±20–40% disagreement between any two tools on the same site — the comparison exercise in the GA migration guide makes this visible.

Which definition to trust

For trends, channel comparisons, and growth direction — the actual decisions visitor counts feed — internal consistency matters more than absolute truth. Pick one tool, keep it constant, compare periods within it. For the cross-visit questions where uniqueness truly matters (did this signup come from last month's campaign?), voluntary identification beats inference: an identify() at signup gives you exact, consented identity for the visitors who matter commercially, while everyone else stays anonymous. That split — precise where consented, aggregate elsewhere — is the honest resolution of the whole problem.