I wonder how this goes with GDPR. It runs on the front-end so it should be OK, but are the legislators, the law and the courts aware of the distinction?