[rvense]

If they're only used for driving down the amount of spam, why don't you say so? You're not the only ones to do this, but I find "there's a problem with your account" demeaning as hell. If you want to use phone numbers to enforce one account per physical person, say so.

This is the spirit of the GDPR, by the way: collect as little information as possible and only use it for purposes that are related to the service you're providing. This seems like a very fair, very obvious deal, and you could just be open about what you're doing.