Author here - we've been able to identify anonymous users pretty consistently once they convert to becoming users. This talks about our approach and how to do it, while still following all the rules around tracking cookies, etc…
For example this quote from the article: "Add a unique identifier to all urls on your site when you know who the user is."
I don't see how our legal would allow us to do this with European customers without explicit opt-in consent since this kind of tracking and data processing cannot be deemed a legitimate requirement for the core function of the service.
If the same service can be given to the visitor without the unique identifier in the URL, then I see no way to avoid asking for consent.
https://gdpr.eu/recital-30-online-identifiers-for-profiling-...
If you look at the examples given they're more like identifiers to something else -- an order id or subscription id.
Wouldn't tracking something like an order (but not the user directly) be ok with GDPR?
Example: if you buy a lawnmower, the seller may he required to notify you of any safety recalls for many years (depending on location). GDPR does not change this requirement for saving personal contact data with the order data, even if the buyer later says “forget me”.
At this point the tracking of the online identifier has certainly passed the threshold into tracking an individual for reasons not directly related to the service.
https://gdpr.eu/article-4-definitions/
"1. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"
The order number in this case falls under "an identification number" and "an online identifier" at the very least.
"2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;"
What is happening is at the very least processing, recording, storing, dissemination, combination of that data.
What is the EU going to do anyway? I've yet to see any meaningfull challenge from EU about GDPR.