Is ActivityPub a blatant violation of GDPR?