Yep, they have GREASE TLS bytes, TLS resume ticket, RLZ value, X-Geo header, UA header, JS APIs with persistent random values (which they do indeed use on adsense! This is why you get surprise WebGL code seemingly doing nonsense once a while in adsense ads)

This cannot be a coincidence. They packed Chrome with fingerprints to work around GDPR by combining fingerprints on their side.

Doesn't that risk massive fines if proven? Like a percentage of all revenue?

I believe they already did lawyerising, as written above.

They grabbed onto the wording of PII as "personally identifiable information" that information is identifiable, but not personally identifiable, so it is ok to use for ads.

So we knows it's you, but you are a integer.

Reminds me of this:

"So here I was now, two years just to the day of being kicked and clanged into Staja 84F, dressed in the height of prison fashion, which was a one-piece suit of a very filthy like cal colour, and the number sewn on the groody part just above the old tick-tocker and on the back as well, so that going and coming I was 6655321 and not your little droog Alex not no longer."

Nothing like a little bit indirection to make it not true. It's blatantly obvious all the ways G can build a profile of someone by fingerprinting. Unfortunately it's not exactly an elevator pitch to make it a common knowledge thing.

“I am not a number! I am a free man!”

— The Prisoner

I don't think this would stand up to scrutiny if the EU was willing to really enforce the GDPR (unfortunately they are not).

Thank you for the list, it could be useful.

Surely fingerprinting is PII? It allows for mosaic identification.

I don't know, are fonts installed on your system PII? Because it can be used for fingerprinting. But I don't know the precise definition, so maybe you're right.

Intent matters. If you use the fonts list to identify persons, it's PII.

Perhaps a reasonable line to draw would be that if the content of the information is enough to fingerprint, the it is PII (regardless if broken into many messages) and the individual data doesn't matter.

If we talk purely about "reasonable", I don't think it's even possible to draw any line, besides something obvious like unique user identifiers. It's hard to predict what data can be used for fingerprinting until someone actually does it, just like it's hard to predict what bugs are actually possible to exploit. I could never predict some of those things being used for that and yet here we are. So it can be a cat-and-mouse type of situation. And some of that information is probably legit useful for purposes other than tracking.

Fingerprinting doesn't reveal an individual's name or passport number, so it's not PII. That's why PII is not a very useful concept in general, and why claims about privacy safeguards that over-focus on PII should be met with some skepticism.

The laws are catching up this in regard. GDPR uses "personal data" and CCPA uses "personal information," both of which more generally refer to data that identifies an individual.

At the same time let's not forget it's Google we're talking about. They are even parsing your emails to extract all the data from your transactions. They already have all your personal information, they just need to keep track of you when you're using other websites.