The Google Analytics terms of service does do not allow to track "data that personally identifies an individual (such as a name, email address or billing information), or other data which can be reasonably linked to such information by Google".

Does anybody have first-hand knowledge if this includes user ids which cannot be resolved by Google but can be linked to actual persons via an Analytics Users CRM system (e.g. a CRM linked to Analytics via API access) ?

I used to think so, but if that where the case many ecommerce implementations would be illegal (since they store transactions id which can be linked to client's purchases).

If anybody has insights about the intended meaning of the paragraph (preferably with a reliable source) it would be great if he/she could share :-)