This is one of those bills that seems like a good idea to the general public. But how do you even define what data is covered and what uses have to be disclosed

This is one of those bills that seems like a good idea to the general public. But how do you even define what data is covered and what uses have to be disclosed and in what level of detail? If someone objects how do you identify them (if there is no login) enough to avoid collecting any data about them without collecting enough to identify them? The legally required compliance with the law is likely to be a giant wormhole. In the end it probably will result in making no difference like the recent EU cookie rule.