There's some major problems with this: "You cannot use any personal identifying data from any visitor who is a one-time visitor." If an IP address is "persona

There's some major problems with this: "You cannot use any personal identifying data from any visitor who is a one-time visitor." If an IP address is "personal identifying data" (as the author subsequently states), then every visitor is a one-time visitor. You can try tracking unique visitors by something else, like some user agent data, but it's less accurate. Ignoring IP means optimizing a site for click-to-sales becomes a lot more vague. If a site converts each unique IP to a hash, then that's one way to get a unique visitor, but then which hash method do you use? MD5 is hackable to anyone having a list of hashes to IP addresses, and anything else can be more complicated and less standardized, so therefore more prone to bugs and bad coding, and therefore more costly to the business. "You cannot load any 3rd party service, because by doing that you would be sending personally identifying data to those services (like people's IP address)." If you can't even load 3rd-party software because they can see IP addresses, then you can't have any tracking, including aggregate, unless you build your own, which can be highly costly and is inherently inefficient with many pre-built solutions already existing and refined, even if they're open-source. This restriction seems just as unreasonable as the first, also based on IP, and I'm not sure the politicians who made this restriction understand the web. "You cannot even do personally identifying internal analytics." If this is true, then you're cutting out a lot of site optimization and sales navigation because you're not always going to be right about what people want or how they will click things on the site. Without IP tracking, you can't follow where someone is going or tie that user to a bug, just get an aggregate of many, which can be vague. "The reason is that a first time visitor hasn't done anything that could be considered consent, so you have nothing to work with." This is incorrect, the user has given consent to make available any info the browser provides, which has to include IP address so the server knows where to send the response. If a politician doesn't understand this, then someone hasn't explained it to them. It is a natural right of a website and publisher to use IP addresses, because they are required for web communication and identifying abusers. How they use it beyond that is what should be regulated, not just the visibility or collection of it. "I don't think publishers realize just what this means." I don't think the politicians understand just what this means either.