@mikey @mastodonmigration The data exchanged as part of federation are covered by the GDPR, as a use of the data necessary to provide the service.
In the Threads case, the problem is not if they use data to cross-federate -- that's just providing the expected service. The problem is in *any other use* of the data.