except Facebook and Google, who have their own identifiers baked-in the client :|
So it's going to favor the monopoly.
> (1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
GDPR and many of the non-UK privacy laws that preceded it in Europe didn't concentrate on cookies but on the user identification concept, but "cookie law stupid" is a meme by now.
If you are talking about the in-app browser, this is an interesting grey area that we should be able to define generically.
The FB app ID is also one of the most common meta tags behind Open Graph.
A nice small example of what this can do can be seen with Clearbit [0] which does a good job of telling you where someone works based off of nothing but their IP address. Imagine that but with the exponentially larger data warehouses of Facebook or Google, paired with referrer tags (FB has CLIDs that allow them but not you to match clicks to actual users) and meta tags (FB can tell exactly what app, page etc a website is associated with and use that data to advertise to users).