> why bother with hashes? Just have the client generate a UUID directly instead of a salt. The reason for all this bonanza is that the ePrivacy directive requi

> why bother with hashes? Just have the client generate a UUID directly instead of a salt. The reason for all this bonanza is that the ePrivacy directive requires a cookie banner, "making exceptions only for data that is "strictly necessary in order to provide a [..] service explicitly requested by the subscriber or user"*. In the end, you only have "pinky promise" that someone isn't doing more processing on the server end, so in reality it doesn't matter much especially if the cookie lifetime is short (hours or even minutes). Actually, a cookie or other (short-lived!) client-side ID is probably better for everyone if it wasn't for the cookie banners.