This is really more like sousveillance[0]. I'm not sure how I feel about it. On the one hand, recording server logs has been standard and accepted practice pretty much since there were web servers. On the other hand, we have the capability to record and discern so much more information now and to do more with that information once we've recorded it.

Ultimately, I think it should require user consent. (And, speaking of consent, I wonder if simple fingerprinting and associating a browser with an ID would violate the GDPR. It's clearly intended to be "personal" to one particular user, but is it "identifiable" information? Does it matter?)

[0]: https://en.wikipedia.org/wiki/Sousveillance