The worst part about this is that it does not require GDPR consent because it is genuinely necessary to store such client data (to detect fake accounts). Same as you don't need GDPR compliance to store someone's address in an online store just to deliver a package to them.
PS. Someone correct me if I'm wrong.