Any data you collect that you do not unambiguously need to provide the service would be an appeal for "legitimate interest" as a legal basis for collecting it.

Any data you collect that you do not unambiguously need to provide the service would be an appeal for "legitimate interest" as a legal basis for collecting it. There are a number of things GDPR writes about it and of course you cannot be sure how this will play out in practice, but the main points are: * it must be reasonable from the user's perspective * there must be alternative; you cannot achieve the goal (your "legitimate interest") without it * it must be balanced with the rights of the user, and not infringe on their freedom or fundamental rights * if your "legitimate interest" is direct marketing, the user can always object, and you are required to actively inform the user of this right See also [1] [1] https://gdpr-info.eu/recitals/no-47/ https://gdpr-info.eu/recitals/no-47/