Sounds like protecting the people by leaving it to them, and (somehow) restricting their internet access if they haven't passed a course in internet jiu-jitsu.

And no: the GDPR isn't just about GA, and it isn't just about the internet; it's about any personal information.