How does this comply to GDPR?

tl;dr: It does not.