Hack17.Alternatives to Cookies

Hack 17. Alternatives to Cookies

While cookies are the most widely used means to identify unique visitors, they are by no means perfect, and a handful of worthy alternatives exist.

Cookies, when properly used, provide a great service to web measurement applications, allowing unique visitors to be tracked from visit to visit and enabling valuable measurements like frequency of visit and lifetime value. Sadly, web site analysts must sometimes do without cookies. There are many reasons for that, such as the following:

• Some visitors actively and consciously disable cookies in their web browsers due to concerns about their privacy. They are essentially opting out of being measured and tracked.

• Some visitors may allow regular cookies set by your web site but disallow tracking cookies set simultaneously by third-party web sites.

• Some visitors may browse your web site from handheld devices that are not always capable of keeping cookies.

• Some web sites make a conscious decision not to cookie their visitors as a symbol of their respect for their clients' privacy. Most typically, this may be the case with websites of banks and other financial services.

Even if your web site attempts to set cookies, there will be a portion of your visitors for whom cookies are unavailable. Web server logfile-based site measurement tools typically uncover that 15 percent of visits to a web site do not carry a cookie. This hack will show you some alternatives.

2.5.1. Reasonable (If Not Great) Alternatives to Cookies

The more sophisticated the web site measurement application, generally the more alternatives to cookies it will offer. Some vendors allow their customers to choose alternatives to cookies to enable the determination of a unique visitor and visit (sometimes referred to as "sessionization").

The following are less accurate but still often useful strategies for determining the uniqueness of a visitor.

2.5.1.1 Using the IP address.

One piece of information that is always available is the IP address of the computer from which the web site received the page request. In the absence of cookies, the most basic web site measurement tools assume that all page requests that were received from the same IP address within a given period of time were issued by the same visitor. This is an assumption with a high degree of error. Sometimes multiple visitors will share the same IP addressfor example when two visitors behind a corporate firewall or proxy server browse your web site simultaneously. At other times, a single visitor will show up in your web site traffic records with differing IP addresses for each page request. This occurs, for example, with visitors using services like America Onlineeach page request may reach your web site from a different proxy server in AOL's pool of servers.

2.5.1.2 Using IP address and user agent strings.

More sophisticated web site measurement tools will not rely on the IP address alone, but at least combine the IP address with another piece of information that is also always available for each page request, the so-called "user agent" string. The user agent is a piece of text that identifies both the computer operating system and the web browser version from which a page request was issued. For example:

 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322) 

Two visitors sharing the same IP address while browsing your web site are unlikely to be using the exact same operating system and browser versions, unless they're in a corporate environment, in which case the likelihood improves. On the average, traffic counts are typically 10 percent more accurate when the measurement tool uses the user agent string along with the IP address versus using the IP address alone.

2.5.1.3 Using the authenticated username (when available).

Measurement tools can also use authenticated usernames to identify unique visitors. If your web site requires visitors to log in with a username and password, you can usually pass the username to your web measurement application. Your measurement software can then use the authenticated username to identify all requests that originated together from a visit. In the ideal case, this is the most accurate method for identifying unique visitors. Alas, the ideal case is rare due to the following two reasons:

• Even if you have a registration web site, there are often public portions of your site that don't require authentication. Any page requests viewed before a visitor logs in will not record the username. Therefore, a measurement tool relying on usernames alone may not be able to make a connection between the portions of the visit before authentication and those after authentication and may mistakenly count two visits where there was only a single visit.

• Even if you have a registration web site, the authenticated username is not always recorded in your web site traffic data. For the username to be recorded automatically, the authentication process needs to use the obscure and unattractive HTTP authentication method. If, however, you use an online form for the visitor to input his username and password, the username will not be recorded as an authenticated username.

In the latter case, you could tag the visitor with his username, but we recommend that you never pass unencrypted personal information via HTTP for security and privacy reasons. Alternatively, you may choose to set a session cookie with the user's name, assuming you have session cookies available.

2.5.1.4 Using a session identifier (when available).

Application platforms like Microsoft's Active Server Pages or Macromedia's Cold Fusion often allow an application-based session ID, one that can easily be passed along using either a session cookie or by appending each page's URL with a session ID. By combining such a session identifier with the authenticated username, measurement tools are able to achieve a high level of accuracy without the need for a permanent browser cookie.

2.5.2. Alternatives to Cookies for Identifying Repeat Visitors

Among these alternatives to cookies, an authenticated username is the only method suitable for identifying repeat visitors to your web site, and is even more accurate than using cookies because:

• When using cookies, multiple users may be recorded as a single repeat visitor. For example, users sharing a home computer or using a kiosk computer appear the same unless they explicitly log in and reset the cookie.

• The same person may mistakenly be counted as multiple unique visitors in your measurements if she is connecting to your site on multiple computers, each with its own unique cookie.

• Cookies have an expiration date that may cause them to expire, or the user may simply delete them at will. In both cases, the connection to previous visits by the same person is lost.

Consequently, for the most accurate web site analysis, try to make intelligent use of authenticated usernames if you have a registration web site. In fact, you may want to use a combination of authenticated usernames and persistent cookies to further improve your chances of making an accurate measurement.

2.5.3. Tying It All Together

Here are three recommendations to consider if you absolutely cannot use cookies to track visitors to your web site:

• Make sure you understand exactly why you won't be able to use cookies. Keep in mind that there are good reasons to avoid cookies, but they are few and far between. Double-check that someone in your organization is not simply making an irrational decision.

• Work backward through the list of alternatives above, starting with session identifiers plus authenticated usernames. You want to use the most accurate strategy possible, given that none of these methods are perfect.

• Make sure you consult with your web measurement vendor. Vendors often have additional insight into your specific problem (the reason you cannot use cookies in the first place); leverage that insight. Never do alone what you can get others to do for youit worked for Tom Sawyer and it will work for you!

Remember, a big part of your success using web measurement tools is tied to understanding how visitors interact with your site over time. By doing everything possible to determine the uniqueness and return visit status of your online visitors, you increase your chances for success.

Akin Arikan and Eric T. Peterson