[carstenhag]

The GDPR doesn't say "You can't do anything", the tldr of it rather is "the user must be informed and/or you must have their opt-in, then it's allowed"