New vs returning visitors: what a good ratio is, and why the number is only as good as your cookies

In your analytics, a returning visitor is not really a person who came back. It is a browser still carrying the cookie you set last time. The distinction sounds pedantic until you notice how easily that cookie disappears: a visitor clears it, opens an incognito window, switches from their phone to their laptop, or simply lands on Safari, which caps the cookies a site sets in the browser at seven days. Each of those turns a loyal returning visitor into a fresh "new" one in your report. So before you benchmark your new vs returning visitor ratio, it is worth asking what the number is actually counting.

Key takeaways

• New visitors are first-time visitors; returning visitors have been to your site before. In standard analytics, "before" means "still carrying a cookie from a past visit," which is a narrower and more fragile thing than it sounds.
• A common rule of thumb puts a healthy returning share around 30 percent or more, but the right ratio depends on your site's age and type, and the number is only as accurate as the cookies it is counted from.
• The count is systematically wrong in one direction: cleared cookies, incognito, Safari's cookie limits, and device switches all inflate "new" and undercount "returning."
• Recognizing a returning visitor by the device rather than a cookie gives a truer split, because the device survives the resets that erase a cookie.
• Recognizing a device is not the same as identifying a person. The goal here is an honest count, not revealing who someone is.

What are new vs returning visitors?

New visitors are people arriving at your site for the first time; returning visitors are people who have been before. The split matters because the two behave differently: new visitors are top-of-funnel, still deciding whether to trust you, while returning visitors engage more and tend to convert at a higher rate, commonly cited as two to three times first-timers, though the real multiple varies widely by site and traffic mix. Read together, the ratio is a rough gauge of two things at once, how well your marketing brings new people in, and how well your product or content brings them back.

The catch is in how analytics decides who is "returning." A tool sets a cookie on a visitor's browser on the first visit, and on a later visit it looks for that cookie. Find it, and the visit is counted as returning; miss it, and the visit is counted as new. That makes the entire metric a question about one small file in the browser, not about the human being. Everything that follows comes from that single design choice.

What is a good new vs returning visitor ratio?

There is no single correct number, but a widely cited rule of thumb puts a healthy returning share around 30 percent or more, with the rest new. A young site or one running heavy top-of-funnel acquisition will skew new, often 70 to 85 percent new, because it is meeting most of its audience for the first time. An established content site, a community, or a subscription product leans more returning, because it has an audience that comes back. Neither is "good" or "bad" on its own; the ratio only means something next to your site's age, your traffic mix, and your goal for the quarter.

The more important caveat is that the percentage is only as accurate as the cookies it is counted from. A 75 percent "new" result can mean your acquisition is working, or it can mean a large share of your real returning visitors are being miscounted as new because their cookie did not survive. Before you act on the ratio, it is worth knowing which.

Why the standard count is wrong, in one direction

The cookie-based method does not fail randomly; it fails in a predictable direction, inflating new visitors and undercounting returning ones. The usual culprits:

• Cleared cookies and incognito. A visitor who clears their cookies or browses in a private window arrives with no cookie, so a returning visitor is counted as new every time.
• Browser cookie limits. Safari's tracking prevention caps the cookies a site sets in the browser at seven days, so a visitor who returns after a week looks new even though nothing on their end changed.
• Device and browser switching. A person who first visited on their phone and comes back on their laptop carries no shared cookie between the two, so analytics sees two new visitors instead of one returning one.
• Cross-device double counting. Because the same person can be both a new visitor on one device and a returning one on another, the new and returning totals do not add up to your total users, which is why the report so often refuses to reconcile.

It is tempting to assume the cookie is simply on its way out, but the picture is more mixed. In April 2025, Google decided to keep third-party cookies in Chrome rather than phase them out, leaving the choice to the user. The catch for a returning-visitor count is that it never depended on third-party cookies anyway: it relies on the first-party cookie your own analytics sets, which Safari and Firefox still cap and clear, and which any visitor can wipe. So the miscount is not something Chrome's decision fixes.

The result is a metric that quietly measures cookie lifespan as much as loyalty. Your "new" bucket is padded with returning visitors whose cookie expired or was wiped, and the longer your real return cycle is, the worse the distortion gets.

How returning visitors are recognized without cookies

The fix is to recognize the visitor by something more durable than a cookie. Device-based recognition reads the technical attributes a browser and device expose, then combines them into a persistent identifier through device fingerprinting. Because that identifier is derived from the device rather than stored in a cookie, it survives the cleared cookie, the incognito window, and the rotated IP, so a returning visitor is recognized as returning even when the cookie is long gone. The same approach underpins persistent visitor recognition and the broader job of identifying anonymous traffic.

Device recognition for an honest visitor count links a return visit to a prior one using technical device and network signals only, no names, emails, or payment data, so the output is a truer count of your real audience.

Scenario	Cookie-based count	Device-based recognition
Visitor clears cookies	counted as new	still recognized as returning
Incognito or private window	counted as new	still recognized as returning
Returns after Safari's seven-day cookie cap	counted as new	still recognized as returning
Same device, rotated IP	depends on the cookie	still recognized as returning
Same person on a different device	two visitors	two devices, an honest limit of both methods

How to get a truer new vs returning count

1. Read the standard ratio as a floor, not a fact. Assume your real returning share is higher than analytics reports, because the cookie method only ever undercounts it.
2. Segment by browser. Compare your returning rate on Safari against Chrome; a large gap is the cookie-limit distortion, not a real behavior difference.
3. Watch your true return cycle. If visitors typically come back after more than a week, a seven-day cookie cap is erasing much of your returning audience before they return.
4. Recognize the device, not the cookie. Use a persistent, device-based identifier so a returning visitor is matched across cleared cookies, private windows, and device changes.
5. Benchmark against yourself over time. A consistent measurement method tracked month over month tells you more than any one-size-fits-all ratio.

Counting new vs returning visitors with ShieldLabs

ShieldLabs recognizes a returning visitor by the device, not a cookie. You add one JavaScript snippet, and on each visit it derives persistent identification from the device, browser, and network signals, one that holds steady when a visitor clears cookies, opens an incognito window, or comes back on a different network. A visitor your analytics would count as new is matched back to the device you have already seen, so the new and returning split reflects people and devices rather than cookie lifespans.

We tested this against the cases that break a cookie. Running a returning visitor through a wiped cookie, an incognito window, and a jump to a new network, the device-derived identifier still recognized the device we had already seen, where the cookie count logged three separate new visitors. The distortion has a dated cause: in 2019, Safari's tracking prevention began capping script-set cookies at seven days, so on Safari a real returning visitor is counted as new once a week has passed.

ShieldLabs reads technical device and network signals only, no names, emails, or company lookups. It tells you which visits share a device and gives each one a risk score with the anonymity signals behind it, and you read the result through the API and webhooks and decide what it means for your analytics, your personalization, and your abuse prevention. The same recognition that cleans up a new vs returning count is what powers returning-visitor recognition and links the accounts behind one device.

Sources

1. Apple WebKit: Intelligent Tracking Prevention 2.3 (cap on script-set cookies)
2. Google Analytics Help: GA4 understand user metrics (new and returning users)
3. Google Privacy Sandbox: The next step for Privacy Sandbox (April 2025, keeping third-party cookies in Chrome)
4. Wikipedia: HTTP cookie
5. Wikipedia: Web analytics