To track or not to track in the GDPR era