GDPR doesn’t say you can never use any form of user data. It says a lot about what data is considered personal, what kind of disclosure and consent you need to setup first (mostly terms of service stuff), how you can store that data, how you can use it, and what responsibilities you have to remove or produce a copy of that data on demand. Until you’ve implemented GDPR it can be hard to understand what it is. But it’s not a super bonus +1 magic shield for all information.