Reply to post:

They don't have to be harvesting anything to be a liability. The GDPR fines, breach notification and subject access request requirements are enough to make running anything for free way too risky to be worthwhile.