The law is about tracking, in fact it's about data protection which is a step removed from tracking, tracking is just a principal route to PII acquisition. The

The law is about tracking, in fact it's about data protection which is a step removed from tracking, tracking is just a principal route to PII acquisition. The acquisition needs to be through informed consent and the data retention needs to be for the reasons consented to and not extend for periods beyond that (unless you need to keep data to comply with other laws, eg tax).