Lemmy uses a SHA256 digest for its TOTP codes.

Basically every other service (and therefore most authenticator apps) use SHA1.

So although you provide the right secret, you get a different code because it’s derived from a different hashing mechanism

If you’re self hosting (i.e. running it for yourself, your family members and maybe some friends), your use would fall under GDPR’s household exemption

does not apply to … the processing of personal data by an individual in the course of a purely personal or household activity

Thats Article (2)(2)a.

Of course, if you’re taking money or making it available to the general public it’s a different matter.