What this screen proves. Three ways in and none of them is a password: Apple ID, Google, or a phone number with a one-time SMS code (demo code 4821). The GDPR line states what the number is used for, as the client asked.