I don't have a link on hand, but I posted about this recently in an HN article about Fathom.

There is an ePrivacy Directive ammendment that specifically prohibits the use of hashing identifiers (e.g. IP address, browser, OS) to work around cookies, even it a timestamp is introduced to limit the life of a hashed ID.

I'm a privacy advocate myself, yet find this a bit OTT - but that's the ePrivacy regulations, and I think Plausible could get burned here at some point. Presumably they know about this amendment and are betting that there will be no enforcement, or their lawyers have found a weasel-wordy loophole (I doubt the later, as the directive is very specific).