It's true that the GDPR has exemptions for "personal or household activity". Ideally, this should apply to non-commercial Mastodon instances. However, some non

It's true that the GDPR has exemptions for "personal or household activity". Ideally, this should apply to non-commercial Mastodon instances. However, some non-commercial Mastodon instances are now supporting thousands of users. An argument could be made that operating such instances is no longer a "personal or household activity". Whilst I would hope that the local data protection agency would side with the Mastodon instance operator, it does put them in a rather difficult situation. I think this possibility raises a lot of concern for operators of Mastodon instances and other online services.