When you talk about performance hit, are you under the impression that moving this to the server side would be faster? No. So what is the alternative?

If you move everything to apps, apps become the vector.

If you ask for explicit ok online, it becomes like the cookie dialog. Pointless.

Offer an alternative.