The issue is that proving the non-respect of those norms is aleatory. Alphabet or Zoom might say "we do respect GDPR, we do not record calls, perform behavioral

The issue is that proving the non-respect of those norms is aleatory. Alphabet or Zoom might say "we do respect GDPR, we do not record calls, perform behavioral analysis on them etc", IF for some reason I discover a third party have something that can only came from Zoom I might suspect a privacy violation and so file a formal complaint, otherwise I'm almost powerless in 99% of the case. Surely reverse engineering is not illegal, good luck to do so for any services, including the giants like Android, including their baseband etc. Such laws can only work with mandatory FLOSS and open hardware with verifiable builds. Only one absent and the norms are just smoke. Oh BTW USA or EU actors does not change much, formally the USA Patriot Act change things, but only formally because the business model of an USA actor is the same of an EU one.