Subject Access Request (SAR) of data relating to cookies?
<p>Take a search engine (e.g. Google), where user A can make searches without logging in with their account. The search engine collects, processes and stores, over time, a number of data about the user A, such as cookies identifiers, IP address, browsers fingerprint, and the search strings. I think all these are "Personal Data" according to GDPR (right?).
How could user A exercise his right of access to these data? In particular:</p>

<ul>
<li><p>how could user A compile such a SAR, given that the search engine has no identifiable information other than the cookie ID (something like "please supply the personal data you hold about me, identified by cookie ID X"?)</p></li>
<li><p>how could user A demonstrate he is the real owner of those data (and not someone else using the same device/connection)</p></li>
</ul>

<blockquote>
  <p>I think all these are "Personal Data" according to GDPR (right?)</p>
</blockquote>

<p>Can the data controller or another person, "with reasonable means reasonably likely to be used," use that data alone or in combination with other data to identify a natural person?</p>

<p>If yes, it is personal data within the meaning of the GDPR.</p>

<p>If no, it is not personal data within the meaning of the GDPR.</p>

<blockquote>
  <p>how could user A compile such a SAR, given that the search engine has
  no identifiable information other than the cookie ID (something like
  "please supply the personal data you hold about me, identified by
  cookie ID X"?)</p>
</blockquote>

<p>If the cookie ID is personal data, surely the cookie ID would be sufficient? If it is personal data, in that it may tie together data that in some combination can identity a natural person.</p>

<blockquote>
  <p>how could user A demonstrate he is the real owner of those data (and
  not someone else using the same device/connection)</p>
</blockquote>

<p>The data controller is permitted to ask you for information or evidence of your identity (but only such information or evidence as is necessary).</p>

internet gdpr