Ah true. This is solved (well, not solved, but handled) by not having a direct link between usage data and the user. So you store your data as <usage, proxy_id

Ah true. This is solved (well, not solved, but handled) by not having a direct link between usage data and the user. So you store your data as <usage, proxy_id> which references <proxy_id, user_id> which references <user_id, user PII>. This way you can always easily break the connection to PII (if the user requests deletion) while keeping per user data. But true, it's not anonymized in this case.