Arguably, Mastodon is also problematic from a GDPR perspective as ActivityPub doesn't offer a way to control data once it has left the instance (which is the entire point of federation). But something tells me Meta didn't have to hold off on publishing Threads in the EU because it uses ActivityPub. And this account merging may indeed also be in violation.
> ActivityPub doesn't offer a way to control data once it has left the instance
Nothing offers a way to control data once you post it publicly though? You could host a public mastodon with federation off and the amount of data exposed is not really going to be different than if you federate.
