[kzcqt]

>This is so broad and vague that basically if I generate a random number to identify you on my website it becomes your personal data.

That's cool. If something can identify me uniquely then it's personal data.

[kerng]

Totally agree! Especially, if you keep the link between the number and user, which is very often the case. But even without that direct link one would have to demonstrate a certain level of k-anonymity. Maybe GDPR wasn't detailed enough to describe k-anonymity