spam and GDPR (was something else)