Create anonymous UUID, store interactions against this in a separate table, ensure PII is removed prior to storing

which is more or less exactly what netflix did -> the whole thing’s not that hard to find on google

but you need something to distinguish users at least a bit or the data’s equivalent to sales figures

you combine that “not-quite-pii” with other independent data sources that have similar “not-quite-pii” and build a complete picture

the treadmill effect comes from active research in this exact area trying to de-anonymise data sets finding new techniques to get around old ones