Why would you need to know anything but hits/month and ad-revenue/month?
Why don't you just hash the IP-address and count unique users that way?
Why don't you just hash the IP-address and count unique users that way?
My point is that it's never described. Even in the detailed options for those cookie banners that permit you to tweak things. Sure, there are (some) details about "our partners" and advertising etc, but exactly how the service will be improved is never explained.
The reason is simple and obvious: nobody knows. Companies collect data in the belief it will be useful in improving the service, but generally chuck it into a data-swamp and occasionally rake it over to extract basic info like navigation routes.
I'm also rarely convinced that improvements can't be better determined by focus groups and other similar methods.
"Improving our service" is a glib catch-all that rarely stands up to scrutiny.
There may be specific examples where a cookie is genuinely the best method to improve a feature -- in which case: name the feature, list the metrics, declare success/fail criteria, and stop collecting the cookie after the decision has been made.
Edit: typos.
How would that work? I can't think of any approach where getting the original IP back from the hash isn't trivial.
Alternatively, you could use a new salt every day, which would only allow you to track an individual for a 24 hour period (likely enough for many).
From a stackoverflow post from 12 years ago:
> I know I do 622 million SHA-256's per sec on a Radeon HD5830.
Which would take around 6 seconds to brute force a 32bit address space.
But this is aside the point, as the spirit of the law only allows "processing for legitimate interests". The use of technology, cookies or on the server is irrelevant. If thread OP has evaluated their collection[0] as legitimate, they can use whatever technology within guidelines. Otherwise, even a cookie less data collection would require consent.
[0]: https://ico.org.uk/for-organisations/guide-to-data-protectio...
Edit: The small amount of IP addresses makes it easy to brute force through all of them.
From there, you have a direct correlation between the IP and its resulting hash. Meaning you can easily see what the original input was.
You don’t need to break a hash to know what the original input was.