the problem is that unlike chemical compounds, no two companies have exactly identical business models. banning "specific" behaviors is the exact opposite of w

the problem is that unlike chemical compounds, no two companies have exactly identical business models. banning "specific" behaviors is the exact opposite of what you want, because then companies will rules-lawyer their way around it in the corporate equivalent of "I'm not touching you!" what you need is strong bans on general patterns of activity such that companies decide it's better not to try and find the exact limit and just stay the hell away from it. The model here is fincen "structuring" - it is illegal to avoid financial controls, and it is illegal to try and find ways to get around the monitoring regimes. If you think you've found a clever way to avoid it, that is itself illegal and they will fuck your shit up. https://en.wikipedia.org/wiki/Structuring https://en.wikipedia.org/wiki/Structuring It's not a popular sentiment here on HN where many people's salaries depend on pretending not to understand it, but this is what GDPR gets exactly right. There isn't a prohibition on specific usages of data, there is a blanket ban on using private customer data for any purpose that is not directly related to the provision of serve. People pretend not to understand it because they want to keep doing the things that are prohibited but the regulations are actually quite clear and quite simple. Could the service be provided without the use of the data? If no, use it. If it could, don't use it, and don't collect it. That's the bright-line. If you don't attempt to push the limit, structuring style, then you won't get in trouble.