5 ms·
That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that s
by tappio 2mo ago
That can be implemented. Within a session you don't need to know it's the same person tomorrow, so a per-day key derived server-side is enough to measure that someone took 40 seconds from x to y. No cookie, no localStorage, nothing stored on the device, nothing to consent to. Hash ip + user agent + your domain with a secret salt that rotates and is destroyed every 24 hours, and you are on the safe side.
Of course, recognizing users across days requires consent. But is that really necessary?
- anonreplier 2mo agoIn the world of zscaler, CGNAT & corporate proxies, IP address is nowhere near enough.
- inigyou 2mo agoOr use some JS to put the time-on-page in the next request, right? Is it a violation to send data that could theoretically be used for more invasive tracking than you actually do? I don't think so, or else you'd need consent just to receive an IP packet.