GDPR would be the obvious one, particularly the bits about them not being allowed to refuse service if you don't agree to data processing that isn't strictly ne

GDPR would be the obvious one, particularly the bits about them not being allowed to refuse service if you don't agree to data processing that isn't strictly necessary to provide the service (e.g. sharing data with insurance companies)