You are conflating identification of a person by behaviour analysis with matching an ID. What is the ID is irrelevant here - may as well be a hash. That just proves my point that this project is not compliant.

I remember when I learned that IP was considered personal information, I was shocked. But I thought about it and it does make sense.