The intent of the GDPR is to prevent the act of non-consensual tracking and not some specific technical method of achieving that, so even a deterministic ID gen

The intent of the GDPR is to prevent the act of non-consensual tracking and not some specific technical method of achieving that, so even a deterministic ID generation method that doesn't rely on any client-side storage would still be in scope, as would a hypothetical crystal ball if it worked better than random chance at reidentifying a unique user.