This is kind of the case. Under GDPR, the data can only be used for the specific purpose for which is was collected, unless explicit consent is obtained. Terms buried in contracts do not count as consent - a contract has to be clear about the purpose for collecting the data and why it is necessary to fulfil the contract, and using the data for any other purposes is illegal.

Yes, despite all the hate GDPR gets from people who have to implement it and from companies whose business model is parasitic, it does seem to go in the right direction.

However, I doubt it can be extended to training statistical models. LLMs and other models by their nature strip attribution which ironically happens to be the trick they are trying to use to break pretty much all open source licenses.

/me laughs in legitimate-interest