[ldjb]

It's true that the GDPR has exemptions for "personal or household activity". Ideally, this should apply to non-commercial Mastodon instances.

However, some non-commercial Mastodon instances are now supporting thousands of users. An argument could be made that operating such instances is no longer a "personal or household activity".

Whilst I would hope that the local data protection agency would side with the Mastodon instance operator, it does put them in a rather difficult situation.

I think this possibility raises a lot of concern for operators of Mastodon instances and other online services.