But does that work?

Do they repopulate it from other sources (IP address, browser fingerprint, flash cookies, etc)?

If it's that straightforward, why isn't it addressed in the privacy policy, which only addresses privacy management for users who log in, while explicitly acknowledging that you can be a user of the services without logging in?