Whatever public education campaign they are running over there must be incredibly misleading. Read it. It doesn’t just say “hey guys, stop doing nefarious things with people’s data*. That may be how it was sold (and is now apparently being explained) to the public, but that’s not how it was implemented.

Your argument would be much more convincing if you shared with us what your company is doing with its users’ data. The fact that you’ve failed to do so suggests that your use case might not be that innocent, in which case it’s a good thing that GDPR makes you cease it.

We let people log in. That’s pretty much it.