Some web services will notify the user if the account name they are entering exists or not. However, I am wondering if this would be legal? For example, if someone entered the email address of someone in the E.U., you would inadvertently be leaking their personal data by saying whether or not they use the service.
The GDPR even places restrictions on what personal data you can store. This seems to imply that you would need consent to store whether or not someone uses your service. It is easy enough to get consent to store who is using it, but how to get consent from every EU citizen who doesn't use your service? After all, according to the GDPR, personal data are "any information which are related to an identified or identifiable natural person." If someone does not use the service, it is pretty easy to identify that fact by looking at the user database.
So, would revealing or storing whether or not an EU citizen uses your service constitute a GDPR violation?