The funny twist is that it seems pretty hard/even impossible to handle GDPR laws and could be punishable under GDPR to have enough verification. All you know a

The funny twist is that it seems pretty hard/even impossible to handle GDPR laws and could be punishable under GDPR to have enough verification. All you know about a user is its name. How can you verify someone identity while still not being "overly burdensome" (which is required by GDPR)?