That stuff is completely ridiculous. If your news aggregator ran a ML-based application to filter out science-related articles so as to keep out click-bait, bog

That stuff is completely ridiculous. If your news aggregator ran a ML-based application to filter out science-related articles so as to keep out click-bait, bogus articles, you'll be able to continue running it without any problem. It doesn't even have anything to do with GDPR. Ah, yes, if what your ML application does is suck user data on one end and produce "useful" information on the other end, then you will have a hard time explaining users why you need to collect all that data and why you need to hold it in storage for as long as you do. Because, indeed, you don't really know how that data is processed, nor how long do you really need to keep it. (This is very much an oversimplification though; many ML-based things don't necessarily fall under the rule about automated decision-based making) Both are pieces of information that should be essential to making an informed decision about whether or not to allow private data to be collected. If you can't provide it, you need a better business plan. I'm really sorry that your founder won't be able to buy that new yacht this summer but it's hardly my problem -- and it does nothing to stiffle ML progress. In fact, if anything, it'll be beneficial to society if some smart people give up doing ML to show ads and go someplace where they can apply ML to something useful.