As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:
Suppose I assign a user a randomly generated ID and store that ID in a database on my server and in a Cookie on the user's browser. This ID can be used to identify the user as "that specific user" (although I know nothing more about that user, just that the ID's match). Is this already personal data, or are any additional data points (videos that this user watched, in my case) considered personal data as the previously stored ID allows a clear assignment to a specific user (by ID)?
I am struggling to wrap my head around the idea that any data in combination with a unique identifier is supposed to be personal data, as in the example above, the user can be identified as a specific user, but arguably, no one could ever match that user to an actual, natural person?
For example, if I assign a visitor of a website an ID and additionally store his/her favourite colour, how is this even personal data?