In the eyes of the law, how is storing and sending the guid later different from storing and sending a cookie?
Edit: the GPDR link specifically says identifier numbers are personal information, and I don’t see a carve out for allowing targeted marketing campaigns to use them to measure/improve targeting performance.
Wrong link, maybe?