@leah
I think mastodon and similar are in a good position regarding GDPR.
Probably all of the data processing done falls under "needed to provide the service", and there's no(*) shady other processing going on (e.g. tracking, facial recognition) which would not have been obvious to users when signing up.
That is, I think it's fair to say that users have given active, informed consent to the processing of their data for the purpose of posting and receiving short messages.
I think data export, subject access, data portability is the only thing might come up, so maybe 'export users data' is a needed function?
(*) -- (Assuming there's not secret things beyond that, in which case...