Actually, even without "tracking" individuals, the metadata is still there. I can see from my own anonymous, privacy-respecting server stats exactly how many hits are coming from Android versus GNU/Linux. There is no personal data involved, but the OS "fingerprint" is clear. If a small, self-hosted blog can see that high-level data, then a bank or a government gateway definitely can. The comparison to anti-piracy doesn't quite work because you don't have to "log in" to a pirated movie, but you do have to authenticate for the services that actually matter. That's where the compliance gate gets locked.