It is insufficient to only mask PII because behavioural data can in some cases uniquely identify an individual, such as purchasing history. You have to destroy all data from the user.

By the way it is this stuff that is so maddening about GDPR. The EU steadfastly refused to be helpful by even answering frequently asked questions clearly.