I’m not a lawyer but I suppose it would depend on the ToS and if the user agrees to the recording and processing. But if it allows the extraction of the real identity of the user it’s probably a GDPR issue.