If you need to track individuals: don't record any personal data and a short keep-alive of sessions/ids of just 20 minutes.

The biggest risk is that with this you are building infrastructure to do more "malicious" tracking easily. Alternatively use logs/server sided events only I guess.