IP address (which can be geolocated) along with a unique identifier is not considered "personal data"? This is basically a tracking cookie. It also seems to use HTTP, which is itself widely fingerprintable based on what request headers it sends.