I think browser fingerprinting is the new hotness. They like that because all it requires is JavaScript, is independent of easily hideable things like IP, and is extremely hard to combat as long as JS is enabled, which you can further ‘encourage’ by making it a shitty single-page web app that requires JS to even render.