Yes, I think we should generate a random UUID if we don't have one. Later we could assign a CID to an API client if we wanted I guess?

https://developers.google.com/analytics/devguides/collection/protocol/v1/parameters#cid

"This anonymously identifies a particular user, device, or browser instance. For the web, this is generally stored as a first-party cookie with a two-year expiration. For mobile apps, this is randomly generated for each particular instance of an application install. The value of this field should be a random UUID (version 4) as described in http://www.ietf.org/rfc/rfc4122.txt"