Basically, for any data you give a company, you have to be able to later on have them remove it, or at least remove the association with you. For stuff like personal messages or posts, just anonymizing won't even be enough to comply.

This is grossly oversimplified to the point of almost being wrong, but is the general idea of what applies here.