I work for a German company and am responsible for GDPR implementation. I would not suggest following the advice in the article. It is full of mistakes and bad advice and would easily put you at risk for a law suit, at least in Germany.

If you are coming at this from any perspective other than "what is the minimum data I need to collect to run my service" then you aren't following the GDPR.

I've noticed that a lot of US based companies claim GDPR compliance but when you read their privacy policy, they clearly aren't compliant. The biggest violations come from what companies try to claim as "legitimate interest." Things such as analytics tracking, that are not tied to service delivery, are not acceptable under legitimate interest. Sharing my visit with Meta will never be legitimate interest. And so on.