Why do you think not being willing to put resources to comply to rules equals to intentionally "spying on their users"? How come you think the rules assert that

Why do you think not being willing to put resources to comply to rules equals to intentionally "spying on their users"? How come you think the rules assert that businesses are not able to spy on their users without their consent? You should better look what's inside the law's box instead of just looking at the packaging.