Plus, even if you do all of those things properly, you will still need to field GDPR data requests, and when you tell users that you don't have any data, they might not believe you. You also might be falsely accused of violating the GDPR, and just saying "no we aren't violating the GDPR" without relying on legal advice is not a good approach if you care about the future of the company.