Comment by mmooss

They don't have to tie it back to an individual, only to an account or, if they respond quickly enough, to a set of activities or traffic pattern.