Well, except there's nothing stopping a site from handing out a unique service worker with a hard-coded i.d. to every visitor. It's persistent state with behaviour, like a cookie that can do things.