The GDPR has no rules around "activity", and lots of justifications available for "necessary to the business", in this case to continue to allow people to play the games they've paid for.

Only angle I can see that this might work for is reducing the number of people you have to email when you get breached.