There's no simple "compliant" checkbox here. It's a balance of risks, since there's no single regulatory PII-management regime. And in this case, it's a huge

There's no simple "compliant" checkbox here. It's a balance of risks, since there's no single regulatory PII-management regime. And in this case, it's a huge toxic liability that adds almost no value over an email address.