Replying to @null and @SimonDeDeo, @matthewstoller, @joftius
That’s a good case; and as often with the GDPR it will boil down to reasonableness and proportionality. The dev is almost certainly off the hook, unless it’s actually their business, they’ve made false claims, have been shockingly bad, etc.