Hacker News Reader

> Just to clarify, GDPR has nothing to do with cookies.

Not strictly true, they are highlighted as a potential source of PII. https://gdpr.eu/cookies/

But as others have pointed out, the law is extremely technology-agnostic. Sticking the same information in a JWT makes no difference either way.