What Is a Session in Web Analytics (And Why It Differs by Tool)

A "session" is one of the most used metrics in web analytics — and one of the most inconsistent. The same website can show 10,000 sessions in GA4 and 7,000 in a cookie-free tool for the same period. Neither is wrong. They're measuring different things using different definitions.

The GA4 definition

In GA4, a session starts when a user arrives at your site and ends after 30 minutes of inactivity. If the same user returns within that 30-minute window after leaving and coming back, it's still the same session. Midnight also ends a session, regardless of activity.

GA4 identifies sessions using a combination of a _ga cookie (which persists for 2 years) and a _ga_XXXXXXXXXX session cookie (which resets on new sessions). The session count is tied to the session_start event.

The result: GA4 can track a user across multiple days and attribute all their visits to the original source.

Cookie-free sessions

Without cookies, a tool can't identify the same user across different days or browsers. There's no persistent identifier — each visit is evaluated on what's observable in the current request: IP address (or a daily hash of it), user agent, and sometimes referrer.

In Gauss, a session is defined as a sequence of page views from the same visitor within a rolling 30-minute window, within the same day (by the site's timezone). The visitor is identified by a daily anonymous hash of IP + user agent — the hash changes every day and is never stored.

This means:

• If someone visits at 11 PM and comes back at 12:01 AM the next day, that's two sessions — two different daily identifiers.
• If someone switches from WiFi to mobile data, the IP changes and it may count as a new visitor.
• Cross-device visits (desktop at work, phone at home) are always separate.

Neither definition is "right" — they reflect different tradeoffs between precision and privacy.

Why session counts differ

The most common reasons for discrepancy:

1. Bot filtering. Some tools filter bots aggressively (blocking crawlers, headless browsers, known datacenter IPs). Others count everything. If your site has significant crawler traffic, this alone can cause large differences.

2. Session timeout. The 30-minute default is common, but some tools use different thresholds. A user who reads a long article without clicking anything may "expire" at different times in different tools.

3. Cross-day boundary. GA4 sessions span midnight. Cookie-free sessions by definition reset at midnight if the hash resets daily.

4. Campaign sessions. GA4 starts a new session when a user arrives via a new UTM campaign, even within the same 30-minute window. Many simpler tools don't do this.

5. Consent. If your site has a consent banner and GA4 only fires after consent, you'll lose sessions from users who decline. Cookie-free tools that fire before consent (or without it) capture those.

Which metric to trust?

For comparing periods within the same tool: sessions are reliable. The definition is consistent, so trends are meaningful.

For comparing tools: sessions are not comparable. Use page views instead — they're more consistent across implementations (every tool counts a visible page load, even if they label it differently).

For channel attribution: cookie-based tools win here. Without cookies, you can see which source a session came from, but you can't connect a user's session today to a conversion they made after three visits over two weeks.

What about "users"?

Users in GA4 are defined by the _ga cookie — a persistent ID that lasts 2 years unless deleted. This means GA4 can de-duplicate the same person returning 50 times and count them as 1 user.

Cookie-free tools count "visitors" — typically unique daily visitor identifiers. If the same person visits Monday through Friday, they're counted as 5 visitors (one per day), not 1 user.

This is the most significant practical difference. "Users" in cookie-based tools are longitudinal; "visitors" in cookie-free tools are daily snapshots.

Session metrics that still work without cookies

Even without persistent user IDs, these metrics are fully reliable:

• Page views: counted per request.
• Top pages: which paths get traffic.
• Entry/exit pages: where visits start and end within a session.
• Bounce rate (or engagement rate): did the visitor see more than one page?
• Traffic sources: referrer and UTM parameters are visible per session.
• Goal completions: conversions within the same session.

What doesn't work well: multi-session attribution (last-click vs first-click across visits), cohort analysis, and anything that requires identifying the same person across days.

The practical takeaway

If you're switching from GA4 to a cookie-free tool, expect lower session counts. The gap is usually 10–30%, mostly explained by the daily hash reset and lack of cross-day session continuity.

This doesn't mean you're losing traffic — it means you're measuring differently. Calibrate by comparing page views first (they should be close), then look at channel breakdown and top pages. If those match, your session difference is definitional, not a data quality issue.