But you probably received the data anonymized, i.e. you had a code that meant a person, and you could track information on that person, but you couldn’t immediately know who that person was.

Otherwise that company, and whoever sold it its data, are in for a BIG lawsuit from any EU citizen you track. And you might say “who cares, my company didn’t act in the EU”, but whoever sold you the data certainly does, and they would get sued and fined very heavily, so it’s unlikely they would not anonymize the data before selling it.