Comment by tappio
1 day ago
That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side. Of course, recognizing users across days requires consent. But is that really necessary?
Or use some JS to put the time-on-page in the next request, right?
Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.
In the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.