I wonder if there is some way to DoS the tracking services by basically accepting third party cookies but then immediately discarding them so every page load generates a new cookie and presumably state stored on the other end to match it. Or are these tracking cookies typically self-contained so that no state is stored server-side?

Given that web industry uses no-server-state for *authentication* (with all the issues it implies), i would expect tracking also be no-server-state.

Isn't that the reason cookies were invented in the first place? To keep servers stateless?