I was thinking, massive is the sense that any (business) user of the service might be considered in breach of GDPR for obtaining personal datan without consent.