We've had to think about this for GDPR. They are contact details that you're giving to a business to contact people. Your email provider needs them, your phone

We've had to think about this for GDPR. They are contact details that you're giving to a business to contact people. Your email provider needs them, your phone company needs it, your cloud contact manager does it, etc. I think it's not worth debating to start arguing that we can't use addresses and phone numbers to contact people. That's their whole point. It's when they're being gathered without informed consent it's a problem or if they get stored without explicit consent past the reasonable use you needed them for. If I click a button saying "look for my friends", was there a reasonable expectation that FB or LinkedIn or WhatsApp or whoever would then keep that data forever. FB will argue that obviously you wanted to keep on checking that list. But what about combining different people's list, processing the data in unexpected ways, actually clearly telling the user the list will be stored indefinitely, etc.