Yes it does. Indeed it also does mean the GDPR kicks in (on the 25th) All you need to be able to do though is say what you're using the information for. If tha

Yes it does. Indeed it also does mean the GDPR kicks in (on the 25th) All you need to be able to do though is say what you're using the information for. If that is "To allow you to log in to your account" and "Your IP and page requests are logged and kept for 2 weeks to for traffic analysis and troubleshooting" you're good to go - just say that on the sign-up form[1]. If you want add the email address to a mail list too you need to add an opt-in consent checkbox and a bit more information on what the checkbox agrees to. If you want to pass along the information (indirectly, I know) to Google Analytics for example then you have to mention that too, and don't load the GA snippets until the user has accepted that You also need a way to tell a user what data you have on them and delete the data where appropriate if the user requests it. You do not need to automate this process, chances are you'll never get either of those requests. Do Things That Don't Scale[2] applies when it comes to the user's ability to request info/deletion It's just another cost of doing business like if you want to take card payments don't store the card number without getting PCI compliant. Don't store user info without getting GDPR compliant. This whole thing is good for all of us as users of sites and software too [1] Actually for a signup form you don't need to say you're using the information to sign them in, that's "unambiguous consent", as long as you're not doing anything but registering them and signing them in you can avoid clogging up your form with that information [2] http://paulgraham.com/ds.html http://paulgraham.com/ds.html