Last week, the browser company Brave alleged that Google was using a mechanism called "push pages" to work around restrictions on the sharing of personally identifiable information (PII) laid out by the EU's General Data Protection Regulation (GDPR). It did so, Brave said, by assigning a distinct, almost 2,000 character-long code to user information shared with advertisers.

Google issued a response to the site Tom's Hardware saying that it does not "serve personalized ads or send bid requests to bidders without user consent."

Google's ad practices are already facing an inquiry by the Irish Data Protection Commission (DPC), specifically with regards to how well they comply with "GDPR principles of transparency and data minimization." However, regulators attempting to enforce the anonymization of user data could find it difficult to keep pace with companies looking for new ways to both comply with privacy requirements and protect the online advertising revenue that is central to their business.

Jarno Vanto, a partner in the privacy and cybersecurity group at Crowell & Moring, thinks part of the problem is most of the information that's collected about users online nowadays could potentially qualify as personal identifying information (PII).

"Ad tech companies are now trying to come up with ways on the one hand to comply, but then they are still stuck in the old world where they were able to collect all of this data because they could rely on this distinction between non-PII and PII, and that's no longer really a valued distinction," Vanto said.

Google may not be the only online business looking to the DPC or other regulators for guidance on what sufficiently constitutes the anonymization of data. Debbie Reynolds, founder of the data privacy and cyber response firm Debbie Reynolds Consulting, believes other companies will be looking towards the outcome of the DPC's inquiry with interest as they try to align their own data practices with compliance and profitability.

Still, she's not expecting much in the way of new parameters surrounding what constitutes a unique identifier.

"I don't think the regulators are going to try and go out of their way to create new words or new definitions," Reynolds said.

But that may still leave them in the unenviable position of having to police companies who continue to look for creative compliance approaches that don't jeopardize their advertising business.

Vanto thinks it could be a tough road due to the amount of resources that would have be leveraged in order to keep track of the practices employed by each technology company. However, there's a chance that burden won't be placed entirely on regulators.

Per Vanto, there are tech-savvy privacy activists who have an interest in monitoring such activity, as well as rival companies that may also be inclined to keep their competitors moving towards the same kind of consent-based data sharing models that they are being driven to adopt into their advertising practices.

This may be especially true of smaller tech businesses, who Vanto said have often taken the brunt of GDPR regulatory activity in Europe because they don't have the compliance resources of their larger counterparts.

Reports made to regulators in these instances probably don't carry the same altruistic spirit as they would coming from a privacy watchdog. "It's not entirely motivated by privacy concerns but also financial concerns," Vanto said.