Tracking individual users is how Google Analytics works. Every hit has a "client ID" to tie together hits that came from the same browser. You can trace the actions of an individual in the "User Explorer Report." Although in practice, that's only useful for debugging.

The terms of service prevent you from putting PII into Google Analytics data. It is perfectly acceptable (and even encouraged) to put in an opaque identifier, which connects to PII stored in a different system. That is, for example, how you implement the official integration between Google Analytics and Salesforce CRM.