That same uselessness for long-term identification of users is what makes this approach compliant with laws regulating use of PII, since what you have after a s

That same uselessness for long-term identification of users is what makes this approach compliant with laws regulating use of PII, since what you have after a small time window isn't actually PII (unless correlated with another dataset, but that's always the case).