AT proto is an open network. Everything you do is public by default. e.g. anyone else can just drink from the firehose.
I get the idea behind the GDPR and it's nice to protect consumers but I'm scared for hobby projects like this.
IANAL but at least in the U.S. I'm pretty sure publicly-available data is generally excluded from whatever protections do exist on PII. I'm not sure what, if anything, has been said about this in the EU.