Yeah, if you want the data, you need to be able to handle the data in a compliant way. The other solution is to not collect the data. But since that data will

Yeah, if you want the data, you need to be able to handle the data in a compliant way. The other solution is to not collect the data. But since that data will include things like routine server logs, back-ups of customer records necessary for statutory financial record-keeping purposes, and so on, it's never that easy. With such a broadly written law, you could spend a small fortune on legal advice just to find out what your real, practical obligations are to make a good faith attempt to comply. Keep in mind that this is targeted at user tracking. The intent might have been to go after user tracking, but unfortunately, that's not what the law they made actually says.