Under GDPR this kind of data collection and sharing HAS to be opt-in i.e. with an informed consent. You can’t just bury it in your TOS and/or privacy policy. The user has to be explicitly shown what they are collection, on what basis they are doing it and how they are using it, then give the user the choice to accept or decline that, and they have to respect that decision.
Currently EEA consists of the EU states + some other European countries.
Grim Dawn with Reign Of Terror mod.