Cell phone companies will start providing identifier codes to websites that you visit. https://blog.simpleanalytics.com/vodafone-deutsche-telekom-to-introduce-persistent-user-tracking

And no, GDPR does not cover these cases. I wish people stopped think of regulations as magic pixie dust that can solve whatever problem they have, and instead look at regulations as "the set of rules that are deemed acceptable for the lobbyists to impose on smaller players, but with enough loopholes for them to ignore it completely."