Yea on top of that you can fingerprint the TCP/IP/TLS settings of the user’s connection as an additional point of data: https://nmap.org/book/osdetect-fingerprint-format.html. My gut feel is that browser+tcp+ip+tls fingerprinting can get you pretty damn close to uniquely identifying users without needing cookies.