That’s not entirely true. GDPR covers all forms of storing and processing PII. Wether that is a website or a desktop application, you will need to get opt in from your user to share PII with third parties.

This is not true - both GDPR & ePrivacy rules apply to any software, none of it is specific to websites (although obviously that's where it's most easily abused, and where most of the attention is).