If I have a game or some other online service I host in which:
- It is forbidden for a subscriber to hold more than one account, OR
- Even if it is not forbidden, to detect one person on multiple accounts for abuse prevention (such as enforcing a ban from the service)
does the GDPR prevent me from using any of the following data for the express and singular purpose of accomplishing this goal?
- IP Address
- Email address
- Password hash
- Payment info (hashed, not raw)
- Screen resolution
- Video card model and driver version (via regular graphics API)
- Running process list (as used by anticheat)
- Hardware hash
- Typing/clicking cadence
- Friends lists
- Other on-service behavior (menus accessed, access patterns, etc)
I'm aware of a paper (Greidanus, 2017) that covers the legality of using various methods of client side cheat detection software that uses some of this data, but as the purpose would be different in this case, I assume the conclusion may not necessarily be the same.