The knowledge sources don't explicitly address this exact scenario, but based on what's documented, here's what's relevant:
Mixpanel's opt-out tools are designed to prevent unconsented user data from being sent at all. If a user hasn't consented, the recommended approach is to either:
Initialize the SDK with opt_out_tracking_by_default: true, so no data is sent until the user explicitly opts in. [Protecting User Data]
Use server-side tracking, where your server manages the opt-out state manually before deciding whether to send data to Mixpanel. [Protecting User Data]
For aggregate/anonymous visitor counts without consent, Mixpanel does support a "CNIL exemption"-style approach, but it comes with strict requirements: data must be strictly for audience measurement, not combined with other data, not shared with third parties, and must produce only anonymous statistics. This may limit the depth of analysis available. [Cookies & GDPR]
In practice, if you want a total visitor count (consented + unconsented), that aggregate number would typically need to come from an upstream source (e.g., your web server logs, a CDN, or a privacy-exempt analytics tool), since Mixpanel's SDK — when properly configured — won't fire for users who haven't consented.
So to directly answer your question: yes, that number generally must come from upstream unless you qualify for and implement an exemption-based tracking approach that meets the strict anonymization requirements. Your legal/compliance team should determine which approach is appropriate for your jurisdiction.
