Earlier quoted context omitted.
this would violate privacy laws like gdpr
Why and how? I'm quite familiar with gdpr, btw -- and I don't see how being able to look up a uuid or some other nonsequential identifier via a site to find the owner obviously violates it. There's a strong legitimate interest case for anyone in possession of a global tracking tag being able to find out the owner, I would think.
a uuid on its own is not a problem. but if you can take one and establish a link pii then the uuid becomes a pii risk.