> Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While

> Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.