I think you misunderstand my point. The "tracking" I mentioned is only "actions per {time unit}", for all users. Basically aggregating how many times the "/api/

I think you misunderstand my point. The "tracking" I mentioned is only "actions per {time unit}", for all users. Basically aggregating how many times the "/api/checkout" endpoint is hit. It requires no cookies, it requires no checking of any individuals behavior. The only point of it is if action $FOO decreases dramatically then $FOO might be broken. At no point does that require cookies or personal data or personal tracking. My point was that you don't need cookies or personally identifiable info to be able to make sure a website runs well.