Generally my line is server-side vs client-side.
It is unknowable to me what data you're saving on the server side using information that I willingly sent to the server as part of normal use (eg. my ip, what HTTP calls I'm making).
It's when you start manipulating the client into sending you additional data that things become a problem. This I _can_ see, and it amounts to an attempt to trick my own user-agent into revealing information that should be private. In other words, your client-side code is now officially malware, and I will block it if I can or just leave the malware-infested site if I can't.
I could make an exception for tracking that is a) high value, b) aligned with my goals as a user, and c) as respectful as possible of my privacy (eg. anonymising values, only taking what info you need).
The b) condition there is most nebulous - I'm mainly thinking of things like reporting client-side javascript errors. This is aligned with my goal of your site being bug-free so I can use it better. Another example would be an (opt-in!) recommendation system that I find valuable. What would NOT be an example of this would be tracking of my actions on the page in order to optimize the chances that I'll engage with the content. Engagement is your priority, not mine.
