Title says it. Apparently lemmy devs are not concerned with such worldly matters as privacy, or respecting international privacy laws.
Short of having someone inspect the databases, they can’t. The GDPR is a threat, basically, that says “if (or, rather, when) the truth outs, we can nail you later”. Which is why it’s really only effective on big players anyway.