Your question touches on two closely related compliance issues, GDPR and ePrivacy. An analysis of the GDPR situation suggests that all of your alternatives involve processing of personal data, but that (depending on processing purpose) consent may not be required. However, ePrivacy most likely does require consent in your case, even when avoiding cookies.
GDPR is fairly flexible and straightforward. For compliance, you must have a legal basis. I recommend starting with these three questions:
What is the purpose of processing?
Answering this question accurately is a necessary prerequisite for the other questions. The same data processed for different purposes can have different compliance obligations.
What is the legal basis for this purpose?
Possible legal bases are enumerated in GDPR Art 6. The most important are:
- necessity for performance of a contract with the data subject
- legal obligation per EU or member state law
- legitimate interest
In the context of online tracking, only consent (opt-in) or legitimate interest (opt-out) are likely to apply.
Legitimate interest requires you to perform a balancing tests between these interests and the rights and freedoms of the affected data subject. Sometimes, implementing additional safeguards can tilt the balance in your favour.
What is the minimum data necessary to achieve the purpose?
Per the GDPR's data minimization principle, you can only process personal data to the degree that it is necessary for a specific purpose. Collecting more data might require another legal basis, e.g. consent.
If the processing purpose can be achieved with pseudonymized data, pseudonymization is mandatory and will not affect a legitimate interest balancing test.
It is important to note that pseudonymized data is still personal data because it still enables re-identification. If direct and indirect re-identification is impossible it can be considered anonymized data that no longer falls under the GDPR. However, anonymization is extremely difficult in practice, so this route should not be relied on to “escape” from GDPR compliance.
A couple of notes in this context:
Google Analytics uses terms with different meaning than in the GDPR. E.g. GA clearly collects personal data (including identifying information), but the terms of service prohibit you from uploading PII. The
anonymize_ip function that truncates IP addresses is likely just a pseudonymization mechanism that doesn't achieve anonymization, especially since the truncated IP address is combined with other information. But the use of this function is still mandatory due to the data minimization principle.
Your proposed solution of hashing a user agent signature into a fingerprint is generally sensible since it makes the individual inputs unreadable. When processed for some purposes, this fingerprint might even be anonymous.
However, your purpose is re-identification of visitors. Only the storage of seen fingerprints involves pseudonymized data, but generating and checking this fingerprint clearly involves processing of personal data. Thus, GDPR applies.
GDPR does not prescribe a legal basis to be used for cookies or browser fingerprints, and there is an argument that cookies or re-identification (on the same site only) could fall under a legitimate interest. But read on.
The ePrivacy directive is famous for its cookie consent requirement. However, it is more broadly about privacy in electronic communications. While it has clear prescriptions, they don't actually apply directly. Instead, every EU member state has its own implementation of the directive. These laws differ in some details, so you must check the variant in your member state.
Traffic data is any data that is necessary for performing a transmission. For a website, this includes IP metadata such as IP addresses, or HTTP metadata such as headers and cookies. Any processing of traffic data that goes beyond what is necessary is allowed only when (a) the data was anonymized, or (b) the user has consented. As discussed above, true anonymization is difficult to impossible, at least in your use case. Important consequences:
- it makes no difference here whether your store an ID in a cookie or whether you use HTTP headers to fingerprint the browser
- in either case, consent is required
Especially with regards to purposes such as cookie-based analytics, we have the awkward situation that the processing itself may fall under a legitimate interest, yet ePrivacy mandates consent. There was an attempt to overhaul ePrivacy in time for the GDPR, but that effort hasn't made any progress since 2017.