Is it possible to create an addon that attempts to associate users not based on IPs, but based on sessions? E.g., X cookie on Ymachine was seen active on the site during a 1-hour period, and was associated with Z users. It wouldn't be firm evidence, as different users may share computers, but this is similarly true of IPs. The data would also be perishable, as cookies change over time, but the same is true of IPs, most of which are dynamic.
Is it possible? Is it legal?