[contubernio]

Does this not violate European privacy laws?

[tosti]

Probably yes it does. Not that it matters when you hack a website to have some expensive jewelry sent to your home address.

[weberer]

So what if it does? They'll get hit with a fine that will be the equivalent of 6 hours of revenue as they continue to be bastards.

[Kipters]

GDPR only covers PII, this is a randomly generated ID that changes on every install on the OS.

You can mix it with other info to track a user, but it's not enough to de-anonymize someone on its own.

[tjoff]

If they associate it with a Microsoft account (or anything that is identifiable) then it becomes PII.

And of course they are.

[totaa]

unfortunately under GDPR, anonymous IDs are personal data as they are used to single out a data subject.

[account42]

unfortunately???