They could probably spy on users in a GDPR-compliant way. GDPR isn't about not tracking users, it is about protecting their personal data. All that analytics pr

They could probably spy on users in a GDPR-compliant way. GDPR isn't about not tracking users, it is about protecting their personal data. All that analytics providers must do in principle is make sure to never associate certain types of data (phone numbers, names, addresses, and similar) to the user fingerprint they use for advertising. As far as I understand (and I could be wrong), the cookie notices exist because analytics providers do not guarantee that this personal data won't be associated with the cookie fingerprint in their systems. Cookies themselves are only mentioned once in relation to this in the GDPR text: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. If the advertising ID/fingerprint was kept unassociated with personal data capable of identifying a natural person, there would be no need for the cookie notice in my understanding. However, I am not a lawyer.