There's an entire sub-industry of companies doing cross device targeting and attribution.
Guess how they're doing it. It's not cookies. It's also why the GDPR is not a "cookie law" and accepting the prompts but blocking cookies is not really a substitute.