2 doesn't work since you actually have to list what you use the data for and keep that list up to date. You think large companies like Google didn't already try

2 doesn't work since you actually have to list what you use the data for and keep that list up to date. You think large companies like Google didn't already try that? > Which do you do? Given that 2 goes out of its way to violate the law and make your users miserable I would suggest 1. But that is just the opinion of a non lawyer.