What I'd really like to see is more honesty: "we store X because feature Y needs it, here's the risk we're accepting," instead of pretending every service needs emails, analytics, and cookies by default

This is what the GDPR requires.