Under GDPR, anything that is personally identifiable can only be collected with the full consent of a user and such data may only be used for legitimate purposes identified under GDPR regulations.