GDPR allows you to remove the data if you discover they cross the line. Optimistically that encourages them to be good citizens about it so they can keep using that data.