We decided that we didn't need to collect the data in the first place, so we sidestep the issue entirely.<p>In reality, the amount of data an application <i>needs</i> to collect is very small. Everything else is mostly for marketing purposes. Eliminate the latter and it's very easy to comply with GDPR.