For the vast majority of sites I would bet using IP address alone would be enough to track enough users individually over their single sessions to be statistically useful.

Does anyone have any experience? How bad does CG-NAT mess this up over a large enough cohort of users?