Comment by danieldk

IANAL, but even UUIDs and hashes of user names can fall under the EU, when there is a future possibility of linking it to a user (e.g. through behavior). See e.g. https://law.stackexchange.com/questions/86570/in-gdpr-terms-...

To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.

https://gdpr-info.eu/recitals/no-26/