They could if the client provided a session-id so they knew which "cookie" to retrive from server-side storage. My proposals is to do that, and have the top bi

They could if the client provided a session-id so they knew which "cookie" to retrive from server-side storage. My proposals is to do that, and have the top bit in the session-id mean "Persistent" or "Anonymous", so that client undisputably controls if anything will be stored about the session. A Pesistent session-ID would be the same next time you visit the site, an Anonymous would be random, and thus not retrive any state on the server side, even if they saved it last time. This would put the privacy decision in the hands of the client, provided we also eliminate crap like almost-per-user-unique user-agent headers.