GDPR does not concern itself only with person-identitifying information, it concerns itself with "personal data" which is defined as "any information relating t

GDPR does not concern itself only with person-identitifying information, it concerns itself with "personal data" which is defined as "any information relating to an identified or identifiable natural person". [1] The GDPR definition of personal data is VERY broad, and it explicitly includes things like: * name, email, date of birth, etc (probably no surprise here) * any user behaviour (what you look at, what you click on) * uploaded content (what you write, your uploaded avatar etc) * ip addresses, device ids * beliefs, ethnicity, sexuality, health data (additional restrictions apply here) * biometric data, genetic data (additional restrictions apply here) [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/