I think we are in a changepoint time where we need to think about how to make privacy serve the user. By that, I mean it's no longer acceptable to cite the lega

I think we are in a changepoint time where we need to think about how to make privacy serve the user. By that, I mean it's no longer acceptable to cite the legal standard, but the ethical one. If you collect data, it should be to serve the user. Additionally, any data not used operationally (keep the service running) should have either be limited by purpose ("we will not use your data to target anything to you") or via true anonymization (differential privacy). If it's not beneficial to the user for you to have this data, you shouldn't have it.