There is a draft web standard Contact Picker. An explicit use case is "bootstrapping a user’s social graph for social networks". I'm interested in the ways this can and can't be used when using legitimate interest as the basis for processing under GDPR.
