"User provided PII" is not the only type of PII that provides a global static identifier

[ehsan]

Assuming that PII that is used to provide a global static ID fror the purpose of online surveillance is always user provided is inaccurate, as the text of this proposal refers to.

Examples for this can be found in research such as the following:

• https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/
• https://freedom-to-tinker.com/2017/09/28/i-never-signed-up-for-this-privacy-implications-of-email-tracking/

[michaelkleber]

Yes, excellent point.