body: If I have a game or some other online service I host in which:
  
  
  * It is forbidden for a subscriber to hold more than one account, OR
  * Even if it is not forbidden, to detect one person on multiple accounts for abuse prevention (such as enforcing a ban from the service)
  
  
  does the GDPR prevent me from using any of the following data *for the express and singular purpose* of accomplishing this goal?
  
  
  * IP Address
  * Email address
  * Password hash
  * Payment info (hashed, not raw)
  * Screen resolution
  * Video card model and driver version (via regular graphics API)
  * Running process list (as used by anticheat)
  * Hardware hash
  * Typing/clicking cadence
  * Friends lists
  * Other on-service behavior (menus accessed, access patterns, etc)
  
  
  I'm aware of a [paper (Greidanus, 2017)](http://arno.uvt.nl/show.cgi?fid=142935) that covers the legality of using various methods of client side cheat detection software that uses some of this data, but as the purpose would be different in this case, I assume the conclusion may not necessarily be the same.
  
  
  
title: GDPR: Detecting duplicate accounts in online services with customer data