GDPR - When does data become personal data, and what exactly comprises personal data?

Question

As a software developer, I am currently in the process of developing a small video analytics tool. I would like to take extra care regarding the GDPR, and have a hard time understanding the following:

Suppose I assign a user a randomly generated ID and store that ID in a database on my server and in a Cookie on the user's browser. This ID can be used to identify the user as "that specific user" (although I know nothing more about that user, just that the ID's match). Is this already personal data, or are any additional data points (videos that this user watched, in my case) considered personal data as the previously stored ID allows a clear assignment to a specific user (by ID)?

I am struggling to wrap my head around the idea that any data in combination with a unique identifier is supposed to be personal data, as in the example above, the user can be identified as a specific user, but arguably, no one could ever match that user to an actual, natural person?

For example, if I assign a visitor of a website an ID and additionally store his/her favourite colour, how is this even personal data?

Answer 1

From Article 4 of the GDPR:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The fact that you can use the ID in your database, along with the value returned by the cookie you set to identify the user makes it personal data.

The favorite colour is information relating to an individual. The fact that it is connected to the cookie ID means that it is personal data.