[mnordhoff]

Is collecting a shipping address because PayPal's JavaScript is broken legal under the GDPR?

[donalhunt]

Yes. Collecting data because it's required to process an order / provide a service would be legal.

You are then responsible for protecting that data too which is why you would prefer not to collect it if possible.