I’d just email the CEO, media relations, and legal (if you can get all their email addresses), inform them of their non-compliance with the GPL and ask them to resolve this swiftly before it needs to be escalated. Then if you don’t hear back in 2 business days, reply all again CCing someone they might care about: local media to their jurisdiction, the FSF, the EFF, etc.
I recall hearing a story about law enforcement identifying an otherwise-anonymous phone by other phones that pinged the same cell towers at the same times. Essentially, the person had two phones on them, so they were able to uniquely identify the individual based on the shared location history of the two devices.
So there’s that, too, assuming my memory isn’t just some CSI bullshit. (It seems reasonable that this attack vector is technologically possible, though, and it may not matter if it’s legal if the identification technique isn’t used as evidence in court.)