Is email verification for account creation in violation of GDPR?
I am creating a new website, and my account creation is incredibly simple, consisting of username, password (stored as hash), and email.
Email is verified at the creation process and is used for password recovery and that is it. Someone had said I may want to look at GDPR (General Data Protection Regulation) and that I may be violating it, opening myself up to liability.
Now, I feel that this is not the case, although I may indeed be wrong. The real question is, where is this line drawn? How is it that this could be illegal (like not stating why I need the email address?) and what can be done if this IS illegal to correct it?
I was not 100% sure where to post this, so I hope this was the correct place if not, I will freely move it/repost it if you think it is better suited elsewhere.
Thank you for reading. Reading about the GDPR is interesting to say the least, as a consumer I love it, as a novice part-time developer I am beyond perplexed by it.