Important to note that privacy laws that regulate tracking are not limited to the Cookie header. They apply to tracking and data collection in general, regardless of how technically clever you make it.

This is part of why I quit my privacy focused analytics start-up years ago. I won’t name it directly, but it was one of the first and is still going strong (although not really open-source anymore).

People kept asking for cookieless tracking but with another way of identifying returning visitors that was always worse from a privacy standpoint. Cookies can be controlled by the client, anything stored on the server can not.

Honestly, cookies are pretty nice, it’s the law around this that sucks. Tricks that attempt to bypass the laws will surely only work for a limited time, at least I hope they will…

If anything, this is worse.

Cookies have built in browser behavior - they have limited scope, the browser lets you see them, they get cleared out regularly.

Abusing metadata is way sketchier.

Exactly. They could have the same functionality and privacy characteristics if they simply kept a cookie that incremented each time the site was visited. The fact that they didn't go this route suggests this is more about finding a way to track unique visitors when cookies are disabled. They are deliberately subverting the user's desire to not be tracked and spinning it as a privacy win.

Well, yes you could have a cookie with C=C+1 and carefully set the expiration to the end of the day (like the article), or you could use randomly generated last-modified times and deduplicate server-side (similar to how cookies are usually used), but I can think of a few reasons the cache would give greater precision, so even if a lot of the same things are the same, I'm not so sure it's really "no different"; these things are pretty important to (some) publishers:

- third-party cookie blocking/notification features in browsers

- review processes on ad networks checking for actual cookies rather than suspicious last-modified times

Yes, cookies are a header field sent back by the browser and so is this.