I'm also very curious about this.

Maybe they hash the IP address. But hashing personal data does not guarantee truly anonymisation. This ressource have more details on the topic: https://cnpd.public.lu/content/dam/cnpd/fr/publications/grou...

good catch! i believe this was a misstatement and have requested we change this wording. for the time being what’s on the docs is what we have https://www.netlify.com/docs/analytics/

It's possible to track using TLS session resumption techniques but who knows whether they're doing this

Might be using browser local storage APIs? Hah. I imagine you could also do some kind of web socket/long poll and try to fingerprint the connection a little so there’s high likelihood it’s the same session when it reconnects between page loads.

I would bet by fingerprinting the visitor's browser window: https://panopticlick.eff.org/