Could this technique be theoretically used to track users themselves? It would be quite ironic if the EU forced tech companies to implement extra tracking, wouldn't it?
At some point it would just be verified accounts for social media and some carveouts here and there, and fines for noncomplience in misattribution and mislabeling.
Or we get into zero trust territory where everybody would assume everything is generated and can't be trusted, unless it's their in-group aligned signaling system.
Beside there is nothing in eu réglementation suggesting that.
I would be astonished if they weren't already doing this.