Wouldn't that be only applicable if they were harvesting people's information submitted by other people? My first thought is that people running Mastodon would

Wouldn't that be only applicable if they were harvesting people's information submitted by other people? My first thought is that people running Mastodon wouldn't qualify as data controllers, but I am no expert in GDPR laws.