I could be oversimplifying this but would the way to defeat GDPR is to make sure an individual cannot be identified through routine web site data collection?