The GDPR is not concerned with "personally identifying information", but "personal data". It defines the latter very broadly, viz: ‘personal data’ means any in

The GDPR is not concerned with "personally identifying information", but "personal data". It defines the latter very broadly, viz: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Even if they're completely stripped of metadata, instant messages are highly likely to contain information that could indirectly identify the sender or recipient.