All Properties of Model are Visible when using $gdprVisible

[matcartmill-old]

In my User model I have protected $gdprVisible = ['name', 'email'];, yet in the JSON output I see

{"id":22,"name":"John Doe","email":"john.doe@testemail.com","created_at":"2018-07-09 14:52:02","updated_at":"2018-07-09 14:52:02","stripe_id":null,"card_brand":null,"card_last_four":null,"trial_ends_at":null,"provider":null,"provider_id":null}

The docs say that anything NOT in the white-list will be hidden, but I don't see this as being the case.

Also, any models included via relationship are also displaying their entire contents.