I think you're almost completely right on this one. Fingerprinting is allowed as long as it is a functional requirement of the website. What IS - to my best knowledge - unknown (or at least a gray area) is whether you can use a fingerprint created as a functional requirement for statistical purposes as an (double emphasis quote) "afterthought".