I worked for a company that was sued for something similar, and as far as I could tell, you're right. You can do nearly any tracking you like, you just have to

I worked for a company that was sued for something similar, and as far as I could tell, you're right. You can do nearly any tracking you like, you just have to be honest about it in your privacy policy. If your privacy policy says "we're gonna look down your pants if we can figure out how", I think you're pretty much free to do so.