Earlier quoted context omitted.
Tracking and advertising cookies are hardly personal information as defined by GDPR, which has a very specific and well defined meaning - name, phone numbers, addresses, government-issued IDs.
GDPR explicitly considers ANY information which identifies you — even pseudonymously generated identifiers, or IPs, or similar stuff — as PII.
> ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
If the tracking id cannot be correlated to a name, identification number, precise location data (not country level), then it's not PII as far as the law is concerned. The criteria is clear: "relating to an identified or identifiable natural person". There is no way that simply a session ID stored in a cookie can be traced to an identity IRL.
I fell that I know what I'm talking about as I designed and implemented an customer authentication system for a medium-sized company that is based in EU, needs to respect GDPR, and I worked closely with their lawyers and operations to make sure we are fully GDPR compliant, and we passed the relevant audits.