I think this is a bad framing.

Javascript running on a page can use a feature that requires a model to be downloaded.

I have pages that use it, or other LLM models via LiteRT or HuggingFace transformers.js.

I try to warn the user, but that is my responsibility as a page author. I like that this is enabling the web platform to remain competitive.

The author is pulling a long bow by trying to claim this is some GDPR violation. Have they ever used the web? There are inefficient sites everywhere, with autoplaying video etc.

4GB isn't nothing, but if a page wants to use it then hopefully it is useful to the user!