The GDPR, as far as I was told when asking a lawyer, covers anything that could contain personal information. If a user chooses to put their SSN into an HN pos

The GDPR, as far as I was told when asking a lawyer, covers anything that could contain personal information. If a user chooses to put their SSN into an HN post, then that post is now also personal data. Or their address. Or if they write in a post that their parent has a specific kind of cancer. Unless you can guarantee that no post contains such data, you should assume them to be personal. And no ToS rule "don't post personal data" will protect you.