> cross-device tracking is on very thin ice legally under the GDPR

Exactly and tracking companies such as Adjust or AppsFlyer carry on IFDA-ing/fingerprinting users. GDPR seems to be just a nice-to-have.