One note: I was the target of a spamming campaign by someone with too much time and bad intent (possibly automated). Under GDPR I asked for my personal data including IP address for the accounts created in my name. Many parties delivered, but some of the privacy professionals noted that since I claimed I did not create the account, the personal data wasn’t mine. I found that unexpected and clever. Never got around to filing a police report and finding the person using the IP address since luckily the harassment stopped.