Uhm no, EU privacy laws are actually pretty simple: do not collect data you don't need without asking consent from a user first.

Which should IMO be the basic principle worldwide. But unfortunately in many countries, companies are more powerful than governments/regulators, so they get to grab everything they can get their hands on.