This way of looking at “visitors” is actually more private than the WebTrends Visitors report. The key is the phrase “personally identifiable information.” A whole cookie value (IP plus unique visitor ID) is personally identifiable if I find out what company owns that IP, go to that company’s office, and look at individual computers’ cookie files to see which computer has that exact cookie. Then, assuming that the person normally sits at that computer is the person who did the browsing, I will be able to say who that person is. Or, alternatively, if the IP address belongs to an ISP such as Comcast.net, I could hope the person had arranged with Comcast to have a permanent, fixed IP. If they do, I could maybe get a court order to attempt to force Comcast to tell me the mailing address and name that are attached to that account. If the person doesn’t have a fixed-IP address arrangement with Comcast, I’d only know, with GeoTrends for example, the approximate geo location served by that particular Comcast proxy.

With just IP addresses as described in this Cool Dimension, the best I could know would be what company they worked for or what ISP they use, plus maybe a GeoTrends location. If five people visited the site from that IP address (i.e. that company), I wouldn’t know who was who.

I once worked at a company where every employee’s computer had a unique IP address but that was long ago. The usual way companies handle it now is giving every employee a unique internal IP address (within the network, starting with 172. or 192. or 10.) but, when the employees browse to outside the intranet, they go through one or more public IP addresses. Hundreds of employees would all be using that same external-facing IP.

I think cookies intrude into privacy if they contain a person’s name or email address that was collected (in a web form filled out by the visitor) when the cookie was set. I’ve seen such cookies, but the SDC cookie is definitely not one of them.

Tying the cookie to a specific customer ID, as you mentioned, is a big problem if you have a lookup table in-house, maybe a CRM, that in turn ties customer IDs to customer names. The customer name is the thing that has to be protected at all costs.