Your mention of "gdpr anonymous" doesn't really give much reassurance, as you can be GDPR compliant but still expose your users to de-anonymization.