Consider GDPR implications of creating guest users with email addresses

At the moment there is one way to create guest user accounts with an email address, through the bulk-add tool on project pages. Once #736 is merged, admins will also have a "Create User" button that can create an account. Are there GDPR implications to creating an account using someone's PII without their prior-given consent?

One possible solution would be to add some text on the verification email to say something like "If you do not want to use Language Depot, click here (link) to delete your account". And/or change the text of the verification email to include GDPR-compliant language saying "Click here to confirm your email address and consent to using your email address as your Send/Receive login". Wording to be figured out later, of course.

Start by reviewing the bulk-add tool on project pages, the planned "Create User" flow from #736, and the verification email. Establish the GDPR requirements and approved wording before deciding whether account deletion or consent changes are needed; done means the requirements and resulting behavior are agreed and documented.