> You also need to let users upload their contact list otherwise you won’t be able to build your social graph.

In the context of legislation like GDPR and CCPA is this even legal in some jurisdictions any more? Genuinely not sure so any insight gratefully received.